8/21/2024 8:00 PM

10/16/2025 4:28 PM

WHD 12.8.3 Hotfix 3 now available

WHD 12.8.3 Hotfix 3 includes all the fixes from Hotfix 1 and Hotfix 2, as well as fixes to address newly discovered vulnerabilities and product functionality issues discovered in Hotfix 1 and Hotfix 2. See WHD 12.8.3 Hotfix 3 release notes.

WHD 12.8.3 Hotfix 2

WHD 12.8.3 Hotfix 2 resolves the following issues:

• Fixes SolarWinds Web Help Desk Hardcoded Credential Vulnerability (see CVEs table)
• Adds more patterns to fix an SSO issue
• Restores missing Upload Attachments, Cancel, and Save buttons in the client application

This hotfix also includes the fixes from 12.8.3 Hotfix 1, which resolve the following issues:

• SolarWinds Web Help Desk Broken Access Control Remote Code Execution Vulnerability (see CVEs table)

CVEs

This hotfix resolves the following vulnerabilities, which includes one previously fixed in 12.8.3 Hotfix 1:

CVE ID	Vulnerability Title	Description	Severity	Credit	First fixed in
CVE-2024-28986	SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability	SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing.   However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.	Critical 9.8	Inmarsat Government / Viasat	Web Help Desk 12.8.3 Hotfix 1
CVE-2024-28987	SolarWinds Web Help Desk Hardcoded Credential Vulnerability	The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.	Critical 9.1	Zach Hanley	12.8.3 Hotfix 2

Note: SolarWinds would like to thank our Security Researchers for reporting on the issue in a responsible manner and working with our security, product, and engineering teams to fix the vulnerability.

About the hotfix

This hotfix adds or modifies the following files:

• Adds the following file in <WebHelpDesk>\bin\tomcat\lib directory:
  • whd-security.jar
• Modifies the JAR files in <WebHelpDesk>/bin/webapps/helpdesk/WEB-INF/lib/:
  • whd-core.jar
  • whd-web.jar

You must manually modify the following file in the <WebHelpDesk>/conf/ directory:

• tomcat_server_template.xml

This hotfix requires Web Help Desk 12.8.3.1813 or 12.8.3 HF1.

Note: In the installation instructions, <WebHelpDesk> represents the Web Help Desk home folder. The default home folders for the supported operating systems are listed below:

• macOS: /Library/WebHelpDesk
• Microsoft Windows: \Program Files\WebHelpDesk
• Linux: /usr/local/webhelpdesk

Web Help Desk

CVE 2024-28987

For assistance, contact SolarWinds Technical Support at:
https://www.solarwinds.com/company/contact-us

Install the hotfix

PREREQUISITE: Web Help Desk 12.8.3 or 12.8.3 HF 1 must be installed before you proceed. See Determine upgrade path for more information.  

1. Stop Web Help Desk.

2. Navigate to the following directory:
   <WebHelpDesk>/bin/tomcat/lib/

3. Copy and paste the whd-security.jar file included with this hotfix to the /lib directory.

4. Back up the following files to a separate directory:

   • <WebHelpDesk>/bin/webapps/helpdesk/WEB-INF/lib/whd-core.jar

   • <WebHelpDesk>/bin/webapps/helpdesk/WEB-INF/lib/whd-web.jar

   • <WebHelpDesk>/conf/tomcat_server_template.xml

5. Navigate to the following directory:
   <WebHelpDesk>/bin/webapps/helpdesk/WEB-INF/lib

6. Copy the files included with this hotfix to the /lib directory, overwriting the following files:

   • whd-core.jar

   • whd-web.jar

7. Navigate to the following directory: <WebHelpDesk>/conf

8. Back up the following file, and then open the original in a text editor:
   <WebHelpDesk>/conf/tomcat_server_template.xml

9. Search for the following tag and place the cursor above it: 
   <Valve className="com.solarwinds.whd.WHDLogger" directory="../../logs"

10. Add the following XML tag text just before the tag in the previous step, if it is not added already:

    <Valve className="com.solarwinds.whd.SecurityValve">
      <Property name="getPatterns">
       <ArrayList>
        <!-- Add your GET request patterns from XML here -->
        <Item>^/api/extraGetPattern$</Item>
        <Item>^/api/anotherGetPattern/.*$</Item>
       </ArrayList>
      </Property>
      <Property name="postPatterns">
       <ArrayList>
        <!-- Add your POST request patterns from XML here -->
        <Item>^/api/extraPostPattern$</Item>
        <Item>^/api/anotherPostPattern$</Item>
       </ArrayList>
      </Property>
        </Valve>

11. Save and close the tomcat_server_template.xml file.

12. Start Web Help Desk.

Uninstall the hotfix

1. Stop Web Help Desk.

2. Navigate to the following directory:
   <WebHelpDesk>/bin/webapps/helpdesk/WEB-INF/lib/

3. Copy your backup files to the /lib directory, overwriting the following files:

   • whd-core.jar

   • whd-web.jar

4. Navigate to the following directory: 
   <WebHelpDesk>/conf/

5. Copy your backup files to the /conf directory, overwriting the following files:
   tomcat_server_template.xml

6. Start Web Help Desk. 
   
   The hotfix is uninstalled.