CVE-2022-36966 - Vulnerability Details

Vendors	Products
Solarwinds	Orion Platform

Link	Providers
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm
https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966

Type	Values Removed	Values Added
Description	Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.	Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-36966", "assignerOrgId": "49f11609-934d-4621-84e6-e02e032104d6", "assignerShortName": "SolarWinds", "datePublished": "2022-10-20T20:05:35.645255Z", "dateUpdated": "2024-09-16T18:48:39.156Z", "dateReserved": "2022-07-27T00:00:00"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "SolarWinds Platform", "vendor": "SolarWinds", "versions": [{"lessThan": "2022.3", "status": "affected", "version": "2022.3 and previous", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Asim Liaquat"}], "datePublic": "2022-10-18T16:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.</p>"}], "value": "Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6", "lang": "en"}]}], "providerMetadata": {"orgId": "49f11609-934d-4621-84e6-e02e032104d6", "shortName": "SolarWinds", "dateUpdated": "2023-08-03T16:58:36.397Z"}, "references": [{"url": "https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm"}, {"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966"}], "source": {"discovery": "UNKNOWN"}, "title": "Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6", "x_generator": {"engine": "Vulnogram 0.0.9"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T10:21:32.223Z"}, "title": "CVE Program Container", "references": [{"url": "https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm", "tags": ["x_transferred"]}, {"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966", "tags": ["x_transferred"]}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2022-36966 (string)

assignerOrgId : 49f11609-934d-4621-84e6-e02e032104d6 (string)

assignerShortName : SolarWinds (string)

datePublished : 2022-10-20T20:05:35.645255Z (string)

dateUpdated : 2024-09-16T18:48:39.156Z (string)

dateReserved : 2022-07-27T00:00:00 (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

platforms : [ »

0 : Windows (string)

]

product : SolarWinds Platform (string)

vendor : SolarWinds (string)

versions : [ »

0 : { »

lessThan : 2022.3 (string)

status : affected (string)

version : 2022.3 and previous (string)

versionType : custom (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

user : 00000000-0000-4000-9000-000000000000 (string)

value : Asim Liaquat (string)

}

]

datePublic : 2022-10-18T16:00:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : <p>Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.</p> (string)

}

]

value : Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.4 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6 (string)

lang : en (string)

}

]

}

]

providerMetadata : { »

orgId : 49f11609-934d-4621-84e6-e02e032104d6 (string)

shortName : SolarWinds (string)

dateUpdated : 2023-08-03T16:58:36.397Z (string)

}

references : [ »

0 : { »

url : https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm (string)

}

1 : { »

url : https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966 (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6 (string)

x_generator : { »

engine : Vulnogram 0.0.9 (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T10:21:32.223Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

]

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:solarwinds:orion_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "01CD6BD2-A53E-4AB1-A08C-00540EC437E8", "versionEndExcluding": "2020.2.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:solarwinds:orion_platform:2020.2.6:-:*:*:*:*:*:*", "matchCriteriaId": "AD239861-0422-45EE-9A3B-EED4F87F38F7", "vulnerable": true}, {"criteria": "cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix1:*:*:*:*:*:*", "matchCriteriaId": "D577F745-35B0-44D8-A457-FD00C4FD4F76", "vulnerable": true}, {"criteria": "cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix2:*:*:*:*:*:*", "matchCriteriaId": "884E1621-E848-4769-BEF6-95A87F52A538", "vulnerable": true}, {"criteria": "cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix3:*:*:*:*:*:*", "matchCriteriaId": "4A60806A-14DE-4E9D-A55E-6DA128EF7661", "vulnerable": true}, {"criteria": "cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix4:*:*:*:*:*:*", "matchCriteriaId": "3E4171F0-1467-431C-A20C-6812045F9992", "vulnerable": true}, {"criteria": "cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix5:*:*:*:*:*:*", "matchCriteriaId": "D8F73D48-6F19-44D9-9F3E-B6AEB78946B8", "vulnerable": true}, {"criteria": "cpe:2.3:a:solarwinds:orion_platform:2022.2:*:*:*:*:*:*:*", "matchCriteriaId": "0A6214D0-6FDD-40F8-9955-CF3D616CB9A3", "vulnerable": true}, {"criteria": "cpe:2.3:a:solarwinds:orion_platform:2022.3:*:*:*:*:*:*:*", "matchCriteriaId": "077EB1C9-5CE5-48D8-9841-D11A2FB41098", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous."}, {"lang": "es", "value": "Los usuarios con derechos de administraci\u00f3n de nodos pod\u00edan ver y editar todos los nodos debido a un control insuficiente del par\u00e1metro URL que causaba una vulnerabilidad de referencia directa a objetos insegura (IDOR) en SolarWinds Platform 2022.3 y anteriores"}], "id": "CVE-2022-36966", "lastModified": "2024-11-21T07:14:10.403", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "psirt@solarwinds.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-10-20T21:15:10.050", "references": [{"source": "psirt@solarwinds.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm"}, {"source": "psirt@solarwinds.com", "tags": ["Vendor Advisory"], "url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966"}], "sourceIdentifier": "psirt@solarwinds.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:solarwinds:orion_platform:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 01CD6BD2-A53E-4AB1-A08C-00540EC437E8 (string)

versionEndExcluding : 2020.2.6 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:solarwinds:orion_platform:2020.2.6:-:*:*:*:*:*:* (string)

matchCriteriaId : AD239861-0422-45EE-9A3B-EED4F87F38F7 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix1:*:*:*:*:*:* (string)

matchCriteriaId : D577F745-35B0-44D8-A457-FD00C4FD4F76 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix2:*:*:*:*:*:* (string)

matchCriteriaId : 884E1621-E848-4769-BEF6-95A87F52A538 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix3:*:*:*:*:*:* (string)

matchCriteriaId : 4A60806A-14DE-4E9D-A55E-6DA128EF7661 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix4:*:*:*:*:*:* (string)

matchCriteriaId : 3E4171F0-1467-431C-A20C-6812045F9992 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix5:*:*:*:*:*:* (string)

matchCriteriaId : D8F73D48-6F19-44D9-9F3E-B6AEB78946B8 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:solarwinds:orion_platform:2022.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 0A6214D0-6FDD-40F8-9955-CF3D616CB9A3 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:solarwinds:orion_platform:2022.3:*:*:*:*:*:*:* (string)

matchCriteriaId : 077EB1C9-5CE5-48D8-9841-D11A2FB41098 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous. (string)

}

1 : { »

lang : es (string)

value : Los usuarios con derechos de administración de nodos podían ver y editar todos los nodos debido a un control insuficiente del parámetro URL que causaba una vulnerabilidad de referencia directa a objetos insegura (IDOR) en SolarWinds Platform 2022.3 y anteriores (string)

}

]

id : CVE-2022-36966 (string)

lastModified : 2024-11-21T07:14:10.403 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.4 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 2.5 (number)

source : psirt@solarwinds.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.4 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 2.5 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2022-10-20T21:15:10.050 (string)

references : [ »

0 : { »

source : psirt@solarwinds.com (string)

tags : [ »

0 : Release Notes (string)

1 : Vendor Advisory (string)

]

url : https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm (string)

}

1 : { »

source : psirt@solarwinds.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Release Notes (string)

1 : Vendor Advisory (string)

]

url : https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966 (string)

}

]

sourceIdentifier : psirt@solarwinds.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-639 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object