CVE-2023-23836

Name of the Vulnerable Software and Affected Versions SolarWinds Platform version 2022.4.1

Description The issue is related to the deserialization of untrusted data in the SolarWinds Orion Platform, which can be exploited by a remote adversary with admin-level access to the SolarWinds Web Console. This allows the execution of arbitrary commands. The vulnerability is associated with deficiencies in the deserialization mechanism.

Recommendations For SolarWinds Platform version 2022.4.1, consider disabling the CredentialInitializer function as a temporary workaround until a patch is available. Restrict access to the SolarWinds Web Console to minimize the risk of exploitation. Avoid using the deserialization mechanism with untrusted data until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.