CVE-2021-35218

Published: Sep 1, 2021Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the Orion Patch Manager Web Console could potentially exploit this and compromise the server

Affected (1)

Products: Solarwinds: Orion Platform

Solarwinds

1 product

Orion Platform

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Solarwinds Orion Platform	Before 2020.2.6

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (6)

https://documentation.solarwinds.com/en/success_center/patchman/content/release_notes/patchman_2020-2-6_release_notes.htm

Source: psirt@solarwinds.com

Not ApplicableVendor Advisory

https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35218

Source: psirt@solarwinds.com

Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-21-1248/

Source: psirt@solarwinds.com

Third Party AdvisoryVDB Entry

https://documentation.solarwinds.com/en/success_center/patchman/content/release_notes/patchman_2020-2-6_release_notes.htm

Source: af854a3a-2127-422b-91ae-364da2661108

Not ApplicableVendor Advisory

https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35218

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-21-1248/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.