CVE-2022-36966: Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-20 · updated 2026-06-17
Weakness: CWE-639

Description

Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.

Affected products

SolarWinds Orion Platform: before 2020.2.6; 2020.2.6, 2020.2.6-hotfix1, 2020.2.6-hotfix2, 2020.2.6-hotfix3, 2020.2.6-hotfix4, 2020.2.6-hotfix5 (+2) — fixed in 2020.2.6

How to fix

Upgrade to a fixed version: SolarWinds Orion Platform 2020.2.6. Check the vendor advisory for mitigations.

References

https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm
https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm
https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966

Get alerted when CVE-2022-36966 or the next vulnerability affects your stack