CVE-2022-36966 Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6

What is CVE-2022-36966?

CVE-2022-36966 is a medium-severity missing authorization vulnerability in SolarWinds Platform, published on 20 Oct 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.

Weakness: CWE-639

Which versions are affected by CVE-2022-36966?

It affects 1 product.

Products include Solarwinds Orion Platform.

How do I fix CVE-2022-36966?

No fix has been published for CVE-2022-36966 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-36966 being exploited?

There is no known exploitation of CVE-2022-36966 in the wild and no public exploit code.

Other vulnerabilities in SolarWinds Platform

• CVE-2020-10148 SolarWinds Orion Authentication Bypass Exploited Critical 9.8
• CVE-2021-27258 Privilege escalation in Orion Platform Critical 9.8
• CVE-2021-25274 Deserialization in n/a Critical 9.8
• CVE-2019-9546 Privilege escalation in n/a Critical 9.8
• CVE-2020-13169 Cross-site scripting in n/a Critical 9.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-259m-9wgg-gmjw.