Product: Web Help Desk
Summary
SolarWinds Web Help Desk is vulnerable to a Java Deserialization Remote Code Execution vulnerability. If exploited, this vulnerability allows an attacker to execute commands on the host machine. The issue was identified by the ZDI team during their research on a previous vulnerability. A patch is now available for all Web Help Desk customers.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2024-28988 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted requests to the Web Help Desk application over the network. Since the attack complexity is low and does not require authentication, an unauthenticated attacker can execute arbitrary commands on the host machine, leading to a complete compromise of the system.
Affected Products
- Web Help Desk: Affected by the Java Deserialization vulnerability allowing remote code execution.
Mitigation
It is crucial for all Web Help Desk customers to apply the available patch to mitigate this vulnerability. Regularly updating software and monitoring for security advisories can help prevent exploitation of similar vulnerabilities in the future.