SolarWinds has rolled out fixes for a newfound security vulnerability in its Web Help Desk (WHD) software. This flaw could potentially enable remote users without authentication to get unauthorized admission to vulnerable instances.
In a recent advisory, the company said, “The SolarWinds Web Help Desk (WHD) software contains a hardcoded credential vulnerability, enabling a remote user without authentication to access internal operations and alter data”.
Marked as CVE-2024-28987, this vulnerability bears a 9.1 rating on the CVSS scoring model, suggesting a high level of severity. The flaw was discovered and reported by Zach Hanley, a security researcher from Horizon3.ai.
To remedy the issue, users are urged to upgrade to the version 12.8.3 Hotfix 2, but the pre-requisite is having Web Help Desk 12.8.3.1813 or 12.8.3 HF1 to apply this fix.
Just a week ago, SolarWinds had addressed another major security issue in the WHD software that could possibly allow arbitrary code execution (designated CVE-2024-28986 with a 9.8 CVSS score).
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has since reported that this flaw has been actively exploited, though the specific manner in which it is being used in actual attacks hasn’t yet been revealed.
Details regarding CVE-2024-28987 are anticipated to be unveiled next month, which further emphasizes the importance of installing these updates promptly to ward off potential threats.
