CVE-2022-36966

Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6

State: Published
Severity: 5.4 Medium
Published: Oct 20, 2022
Updated: May 7, 2025
Reserved: Jul 27, 2022

Description

Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	SolarWinds

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
SolarWinds PlatformSolarWinds	2022.3 and previous to before 2022.3Affected

References

https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm
https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.