Junglewise Threat Intelligence

CVE-2016-3643: SolarWinds Virtualization Manager Privilege Escalation Vulnerability

CVE-2016-3643 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2021-11-03

Vendors: SolarWinds.

Executive brief

SolarWinds Virtualization Manager 6.3.1 and earlier contains a privilege escalation vulnerability due to a misconfiguration of sudo. Local users can exploit this to gain elevated privileges, as demonstrated by executing commands like 'sudo cat /etc/passwd'.

Affected products

  • SolarWinds Virtualization Manager 6.3.1 and earlier

Timeline

  • 2016-06-17: disclosed: NVD Published Date
  • 2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog