CVE-2022-36966

5.4 mediumEPSS 0.5%

Medium (5.4) in solarwinds orion platform. EPSS 0.5% chance of exploitation in the next 30 days.

Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-11-01)
CWE: CWE-639
Published: 2022-10-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

solarwinds:orion_platform

References

https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm
https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm
https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966

Check your stack JSON