#VU72303 Path traversal in Orion Platform - CVE-2022-47506
Published: February 15, 2023 / Updated: February 25, 2023
Vulnerability identifier: #VU72303
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2022-47506
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Orion Platform
Orion Platform
Software vendor:
SolarWinds
SolarWinds
Description
The vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences within the sshd_SftpRename function. A remote user can send a specially crafted HTTP request and update the default configuration, enabling the execution of arbitrary commands.
Successful exploitation of the vulnerability may allow remote code execution.
Remediation
Install update from vendor's website.