CVE-2024-28992

Name of the Vulnerable Software and Affected Versions: SolarWinds Access Rights Manager (affected versions not specified)

Description: The issue is related to the deleteTransferFile method in SolarWinds Access Rights Manager, which is vulnerable due to incorrect restriction of the directory path name with limited access. This allows a remote attacker to read, modify, or delete data and potentially elevate their privileges. The vulnerability enables an unauthenticated user to perform arbitrary file deletion and leak sensitive information.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.