SolarWinds Security Event Manager vulnerabilities

4 CVEs affecting SolarWinds Security Event Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-0692, published 2024-03-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-0692, published 2024-03-01. High severity, CVSS 8.8. EPSS: 92.2% chance of exploitation in the next 30 days. The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse SolarWinds’ service, resulting in remote code…
CVE-2022-38115, published 2022-11-23. Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days. Insecure method vulnerability in which allowed HTTP methods are disclosed. E.g., OPTIONS, DELETE, TRACE, and PUT
CVE-2022-38113, published 2022-11-23. Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days. This vulnerability discloses build and services versions in the server response header.
CVE-2022-38114, published 2022-11-23. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. This vulnerability occurs when a web server fails to correctly process the Content-Length of POST requests. This can lead to HTTP request smuggling or XSS.