SolarWinds, a leading IT management software provider, has recently disclosed two significant vulnerabilities, CVE-2024-28990 and CVE-2024-28991, in its Access Rights Manager (ARM) platform. These vulnerabilities pose serious risks, allowing attackers to bypass authentication and execute remote cod.
-
CVE-2024-28990: Hardcoded credentials allow attackers to access the RabbitMQ management console.
-
CVE-2024-28991: Remote code execution through deserialization of untrusted data.
A service update, ARM 2024.3.1, has been released, addressing these vulnerabilities alongside several bug fixes. SolarWinds emphasizes the importance of timely patching to mitigate enterprise risks.