This allowed users who have Node Management rights to edit any node in the system. This could be abused by an attacker to create a new node with the same name as an existing one, then edit the new node to have the same settings as the original one. If a user had sufficient Node Management rights, they could also delete any node from the system. This could also be abused by an attacker to delete an existing node, then create a new node with the same name as an existing one. An attacker could then delete this new node, then edit it to have the same settings as the original one.
All users with Node Management rights were able to view and edit any node in the system due to Insufficient access control on system settings configuration data exposure vulnerability in SolarWinds Platform 2022.3 and prior.
Summary of the CVE
This allowed users who have Node Management rights to edit any node in the system. This could be abused by an attacker to create a new node with the same name as an existing one, then edit the new node to have the same settings as the original one. If a user had sufficient Node Management rights, they could also delete any node from the system. This could also be abused by an attacker to delete an existing node, then create a new node with the same name as an existing one. An attacker could then delete this new node, then edit it to have the same settings as the original one.
Insufficient access control on system information configuration data exposure vulnerability
SolarWinds Platform 2022.3 and prior are vulnerable to an Insufficient access control on system information configuration data exposure vulnerability. This allowed users who have Node Management rights to view, edit, or delete any node in the system. An attacker could exploit this vulnerability by creating a new node with the same name as an existing one and then editing the new node to have the same settings as the original one.
Reported By: END-USER -17
This is a known issue that has been fixed in the latest release of SolarWinds Platform 2022.3.
Timeline
Published on: 10/20/2022 21:15:00 UTC
Last modified on: 10/21/2022 18:59:00 UTC