{"id":"CVE-2024-23465","aliases":["EUVD-2024-20963","GHSA-86xc-mwv4-f994"],"status":"published","title":"SolarWinds Access Rights Manager (ARM) ChangeHumster Exposed Dangerous Method Authentication Bypass Vulnerability","description":"The SolarWinds Access Rights Manager was found to be susceptible to an authentication bypass vulnerability. This vulnerability allows an unauthenticated user to gain domain admin access within the Active Directory environment.","severity":{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01943,"percentile":0.80322,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2024-07-17T14:27:31Z","modified":"2026-06-17T07:13:00Z","products":[{"vendor":"solarwinds","product":"access rights manager"},{"vendor":"solarwinds","product":"access_rights_manager"}],"references":[{"url":"https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3_release_notes.htm","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23465"},{"url":"https://github.com/advisories/GHSA-86xc-mwv4-f994"}],"sources":{"cve":[{"id":"CVE-2024-23465","title":"SolarWinds Access Rights Manager (ARM) ChangeHumster Exposed Dangerous Method Authentication Bypass Vulnerability","description":"The SolarWinds Access Rights Manager was found to be susceptible to an authentication bypass vulnerability. This vulnerability allows an unauthenticated user to gain domain admin access within the Active Directory environment.     ","status":"published","published":"2024-07-17T14:27:31.092Z","modified":"2024-08-01T23:06:24.653Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:34:05.444281Z"}],"euvd":[{"id":"EUVD-2024-20963","description":"The SolarWinds Access Rights Manager was found to be susceptible to an authentication bypass vulnerability. This vulnerability allows an unauthenticated user to gain domain admin access within the Active Directory environment.     ","status":"published","published":"2024-07-17T14:27:31Z","modified":"2024-08-01T23:06:24Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:28.835632Z"}],"ghsa":[{"id":"GHSA-86xc-mwv4-f994","title":"The SolarWinds Access Rights Manager was found to be susceptible to an authentication bypass...","description":"The SolarWinds Access Rights Manager was found to be susceptible to an authentication bypass vulnerability. This vulnerability allows an unauthenticated user to gain domain admin access within the Active Directory environment.     ","status":"published","published":"2024-07-17T15:30:50Z","modified":"2024-07-17T15:30:50Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:57:42.487659Z"}],"nvd":[{"id":"CVE-2024-23465","description":"The SolarWinds Access Rights Manager was found to be susceptible to an authentication bypass vulnerability. This vulnerability allows an unauthenticated user to gain domain admin access within the Active Directory environment.     ","status":"published","published":"2024-07-17T15:15:10.977Z","modified":"2026-06-17T07:13:00.397Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:10:13.413515Z"}]}}