CVE-2022-36966

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-36966
Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.

5.4 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm Release Notes Vendor Advisory
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm Release Notes Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966 Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:solarwinds:orion_platform:2020.2.6:-:*:*:*:*:*:*
cpe:2.3:a:solarwinds:orion_platform:*:*:*:*:*:*:*:*
cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix1:*:*:*:*:*:*
cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix2:*:*:*:*:*:*
cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix3:*:*:*:*:*:*
cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix4:*:*:*:*:*:*
cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix5:*:*:*:*:*:*
cpe:2.3:a:solarwinds:orion_platform:2022.2:*:*:*:*:*:*:*
cpe:2.3:a:solarwinds:orion_platform:2022.3:*:*:*:*:*:*:*
History

07 May 2025, 21:15

Type Values Removed Values Added
References (CONFIRM) https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm - Release Notes, Vendor Advisory () https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm - Release Notes, Vendor Advisory
References (CONFIRM) https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966 - Vendor Advisory () https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966 - Vendor Advisory

16 Sep 2024, 19:16

Type Values Removed Values Added
Summary Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous. Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.

03 Aug 2023, 17:15

Type Values Removed Values Added
Summary Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous. Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.
Information

Published : 2022-10-20 21:15

Updated : 2025-05-07 21:15

NVD link : CVE-2022-36966

Mitre link : CVE-2022-36966

JSON object : View

Products Affected

solarwinds

  • orion_platform
CWE
CWE-639

Authorization Bypass Through User-Controlled Key