GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-36960 (GCVE-0-2022-36960)

Vulnerability from cvelistv5 – Published: 2022-11-29 20:43 – Updated: 2025-04-24 17:46
VLAI
Title
SolarWinds Platform Improper Input Validation
Summary
SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to escalate user privileges.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-24 17:46 UTC
CWE
  • CWE-287 - Improper Authentication
  • CWE-20 - Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version CPE status
SolarWinds SolarWinds Platform Affected: 2022.3 and prior versions , < 2022.3 (custom)
guessed Create a notification for this product.
SolarWinds Orion Platform Affected: 2020.2.6 HF5 and prior versions , ≤ 2020.2.6 HF5 (custom)
guessed Create a notification for this product.
Date Public
2022-11-21 16:00
Credits
SolarWinds would like to thank Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative for reporting on the issue in a responsible manner.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T10:21:32.333Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36960"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-36960",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-24T17:46:32.884693Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-24T17:46:45.937Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SolarWinds Platform",
          "vendor": "SolarWinds",
          "versions": [
            {
              "lessThan": "2022.3",
              "status": "affected",
              "version": "2022.3 and prior versions",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Orion Platform",
          "vendor": "SolarWinds",
          "versions": [
            {
              "lessThanOrEqual": "2020.2.6 HF5",
              "status": "affected",
              "version": "2020.2.6 HF5 and prior versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "SolarWinds would like to thank Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative for reporting on the issue in a responsible manner."
        }
      ],
      "datePublic": "2022-11-21T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to escalate user privileges.\u003c/p\u003e"
            }
          ],
          "value": "SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to escalate user privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-03T20:34:08.739Z",
        "orgId": "49f11609-934d-4621-84e6-e02e032104d6",
        "shortName": "SolarWinds"
      },
      "references": [
        {
          "url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36960"
        },
        {
          "url": "https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAll SolarWinds Platform customers are advised to upgrade to the latest version of the SolarWinds Platform version 2022.4\u003c/p\u003e"
            }
          ],
          "value": "All SolarWinds Platform customers are advised to upgrade to the latest version of the SolarWinds Platform version 2022.4"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "SolarWinds Platform Improper Input Validation",
      "x_generator": {
        "engine": "vulnogram 0.1.0-rc1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "49f11609-934d-4621-84e6-e02e032104d6",
    "assignerShortName": "SolarWinds",
    "cveId": "CVE-2022-36960",
    "datePublished": "2022-11-29T20:43:38.388Z",
    "dateReserved": "2022-07-27T00:00:00.000Z",
    "dateUpdated": "2025-04-24T17:46:45.937Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-36960",
      "date": "2026-09-17",
      "epss": "0.00914",
      "percentile": "0.58427"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:solarwinds:orion_platform:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2020.2.6\", \"matchCriteriaId\": \"01CD6BD2-A53E-4AB1-A08C-00540EC437E8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:solarwinds:orion_platform:2020.2.6:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"AD239861-0422-45EE-9A3B-EED4F87F38F7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix1:*:*:*:*:*:*\", \"matchCriteriaId\": \"D577F745-35B0-44D8-A457-FD00C4FD4F76\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix2:*:*:*:*:*:*\", \"matchCriteriaId\": \"884E1621-E848-4769-BEF6-95A87F52A538\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix3:*:*:*:*:*:*\", \"matchCriteriaId\": \"4A60806A-14DE-4E9D-A55E-6DA128EF7661\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix4:*:*:*:*:*:*\", \"matchCriteriaId\": \"3E4171F0-1467-431C-A20C-6812045F9992\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix5:*:*:*:*:*:*\", \"matchCriteriaId\": \"D8F73D48-6F19-44D9-9F3E-B6AEB78946B8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:solarwinds:orion_platform:2022.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0A6214D0-6FDD-40F8-9955-CF3D616CB9A3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:solarwinds:orion_platform:2022.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"077EB1C9-5CE5-48D8-9841-D11A2FB41098\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to escalate user privileges.\"}, {\"lang\": \"es\", \"value\": \"La plataforma SolarWinds fue susceptible a una validaci\\u00f3n de entrada incorrecta. Esta vulnerabilidad permite que un adversario remoto con acceso v\\u00e1lido a SolarWinds Web Console escale los privilegios del usuario.\"}]",
      "id": "CVE-2022-36960",
      "lastModified": "2024-11-21T07:14:09.587",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"psirt@solarwinds.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}]}",
      "published": "2022-11-29T21:15:10.693",
      "references": "[{\"url\": \"https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm\", \"source\": \"psirt@solarwinds.com\", \"tags\": [\"Release Notes\", \"Vendor Advisory\"]}, {\"url\": \"https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36960\", \"source\": \"psirt@solarwinds.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\", \"Vendor Advisory\"]}, {\"url\": \"https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36960\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "psirt@solarwinds.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"psirt@solarwinds.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}, {\"lang\": \"en\", \"value\": \"CWE-287\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}, {\"lang\": \"en\", \"value\": \"CWE-287\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-36960\",\"sourceIdentifier\":\"psirt@solarwinds.com\",\"published\":\"2022-11-29T21:15:10.693\",\"lastModified\":\"2026-06-17T04:54:21.347\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to escalate user privileges.\"},{\"lang\":\"es\",\"value\":\"La plataforma SolarWinds fue susceptible a una validaci\u00f3n de entrada incorrecta. Esta vulnerabilidad permite que un adversario remoto con acceso v\u00e1lido a SolarWinds Web Console escale los privilegios del usuario.\"}],\"affected\":[{\"source\":\"psirt@solarwinds.com\",\"affectedData\":[{\"vendor\":\"SolarWinds\",\"product\":\"SolarWinds Platform\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"2022.3 and prior versions\",\"lessThan\":\"2022.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"SolarWinds\",\"product\":\"Orion Platform\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"2020.2.6 HF5 and prior versions\",\"lessThanOrEqual\":\"2020.2.6 HF5\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@solarwinds.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-04-24T17:46:32.884693Z\",\"id\":\"CVE-2022-36960\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"psirt@solarwinds.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"},{\"lang\":\"en\",\"value\":\"CWE-287\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"},{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:solarwinds:orion_platform:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2020.2.6\",\"matchCriteriaId\":\"01CD6BD2-A53E-4AB1-A08C-00540EC437E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:solarwinds:orion_platform:2020.2.6:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"AD239861-0422-45EE-9A3B-EED4F87F38F7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix1:*:*:*:*:*:*\",\"matchCriteriaId\":\"D577F745-35B0-44D8-A457-FD00C4FD4F76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix2:*:*:*:*:*:*\",\"matchCriteriaId\":\"884E1621-E848-4769-BEF6-95A87F52A538\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix3:*:*:*:*:*:*\",\"matchCriteriaId\":\"4A60806A-14DE-4E9D-A55E-6DA128EF7661\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix4:*:*:*:*:*:*\",\"matchCriteriaId\":\"3E4171F0-1467-431C-A20C-6812045F9992\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix5:*:*:*:*:*:*\",\"matchCriteriaId\":\"D8F73D48-6F19-44D9-9F3E-B6AEB78946B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:solarwinds:orion_platform:2022.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0A6214D0-6FDD-40F8-9955-CF3D616CB9A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:solarwinds:orion_platform:2022.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"077EB1C9-5CE5-48D8-9841-D11A2FB41098\"}]}]}],\"references\":[{\"url\":\"https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm\",\"source\":\"psirt@solarwinds.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36960\",\"source\":\"psirt@solarwinds.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36960\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-29T03:13:30+00:00",
      "cve": "CVE-2022-36960",
      "id": "CVE-2022-36960",
      "initial_release_date": "2022-11-21T16:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "SolarWinds Platform Improper Input Validation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-36960.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36960\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T10:21:32.333Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-36960\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-24T17:46:32.884693Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-24T17:46:37.354Z\"}}], \"cna\": {\"title\": \"SolarWinds Platform Improper Input Validation\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"SolarWinds would like to thank Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative for reporting on the issue in a responsible manner.\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"SolarWinds\", \"product\": \"SolarWinds Platform\", \"versions\": [{\"status\": \"affected\", \"version\": \"2022.3 and prior versions\", \"lessThan\": \"2022.3\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"SolarWinds\", \"product\": \"Orion Platform\", \"versions\": [{\"status\": \"affected\", \"version\": \"2020.2.6 HF5 and prior versions\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2020.2.6 HF5\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"All SolarWinds Platform customers are advised to upgrade to the latest version of the SolarWinds Platform version 2022.4\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAll SolarWinds Platform customers are advised to upgrade to the latest version of the SolarWinds Platform version 2022.4\u003c/p\u003e\", \"base64\": false}]}], \"datePublic\": \"2022-11-21T16:00:00.000Z\", \"references\": [{\"url\": \"https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36960\"}, {\"url\": \"https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm\"}], \"x_generator\": {\"engine\": \"vulnogram 0.1.0-rc1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to escalate user privileges.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eSolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to escalate user privileges.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-287\", \"description\": \"CWE-287 Improper Authentication\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"49f11609-934d-4621-84e6-e02e032104d6\", \"shortName\": \"SolarWinds\", \"dateUpdated\": \"2023-08-03T20:34:08.739Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-36960\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-24T17:46:45.937Z\", \"dateReserved\": \"2022-07-27T00:00:00.000Z\", \"assignerOrgId\": \"49f11609-934d-4621-84e6-e02e032104d6\", \"datePublished\": \"2022-11-29T20:43:38.388Z\", \"assignerShortName\": \"SolarWinds\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.