SolarWinds Storage Manager < 5.7.2 Remote Code Execution

critical Nessus Plugin ID 77504

Language:

Synopsis

The remote host is running a web application affected by a remote code execution vulnerability.

Description

The remote host is running a version of SolarWinds Storage Manager prior to 5.7.2. It is, therefore, affected by a remote code execution vulnerability due to a flaw in the 'AuthenticationFilter' class. A remote, unauthenticated attacker can exploit this vulnerability to upload malicious scripts which can then execute arbitrary code as the user 'SYSTEM'.

Solution

Upgrade to SolarWinds Storage Manager version 5.7.2 or later.

Plugin Details

Severity: Critical

ID: 77504

File Name: solarwinds_storage_manager_5_7_2.nasl

Version: 1.11

Type: local

Agent: windows

Family: Windows

Published: 9/3/2014

Updated: 1/2/2019

Supported Sensors: Nessus Agent, Nessus

Risk Information

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:solarwinds:storage_manager

Required KB Items: installed_sw/SolarWinds Storage Manager

Exploit Ease: No known exploits are available

Patch Publication Date: 8/19/2014

Vulnerability Publication Date: 8/27/2014

Reference Information

BID: 69438

Detections

Analytics