CVE-2024-28986

EUVD-2024-26048

13.08.2024, 23:15

SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine.

While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing.

However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 98%

Affected Products (NVD)

Vendor	Product	Version
solarwinds	web_help_desk	𝑥 ≤ 12.8.2
solarwinds	web_help_desk	12.8.3

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
solarwinds	webhelpdesk	𝑥 ≤ 12.8.3	ADP

Common Weakness Enumeration

CWE-502 - Deserialization of Untrusted Data
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References

https://support.solarwinds.com/SuccessCenter/s/article/WHD-12-8-3-Hotfix-1

https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28986

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-28986