Product: Web Help Desk
Summary
SolarWinds Web Help Desk is vulnerable to a Java Deserialization Remote Code Execution vulnerability. If exploited, this vulnerability allows an attacker to execute commands on the host machine. The issue was identified by the ZDI team during their research on a previous vulnerability. A patch is now available for all Web Help Desk customers.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2024-28988 |
Exploitation
An attacker can exploit this vulnerability by sending specially crafted requests to the Web Help Desk application. Since the attack complexity is low and does not require authentication, an unauthenticated attacker can execute arbitrary commands on the host machine, leading to a complete compromise of the system.
Affected Products
- Web Help Desk: Affected by the Java Deserialization vulnerability allowing remote code execution.
Mitigation
To mitigate this vulnerability, it is crucial for all Web Help Desk customers to apply the available patch immediately. This patch addresses the security flaw and helps protect against potential exploitation.