CVE-2022-36966: Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6

Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6

Status

Published

2022-10-20

Updated

2025-05-07

Assigning organization

SolarWinds

Description

Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SolarWinds SolarWinds Platform

Default version status: unaffected

2022.3 and previous to < 2022.3affected

References

https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm ↗
https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966 ↗