SolarWinds - Information Disclosure (CVE-2024-28987)
Description
The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.
psychologyCrowdSec Analysis
The SolarWinds Web Help Desk software is impacted by a hardcoded credential vulnerability, tracked as CVE-2024-28987. This vulnerability could allow remote, unauthenticated attackers to access internal system functionality and modify sensitive data. This flaw exposes organizations to risks such as unauthorized data manipulation, privilege escalation, and potential further compromise of the help desk environment.
CrowdSec has been tracking this vulnerability and its exploits since 25th of October 2024.
CrowdSec has not observed any significant exploitation activity targeting CVE-2024-28987 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit SolarWinds Web Help Desk by sending requests to /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets/ using hardcoded credentials, allowing unauthorized access to sensitive ticket data.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-08-21 |
| CISA KEV | 2024-10-15 |
| Rule Released | 2024-10-25 |
| CISA Remediation Deadline | 2024-11-05 |
| CrowdSec First Seen | 2025-12-17 |