SolarWinds Orion API authentication bypass allows remote command execution

🗓️ 26 Dec 2020 00:00:00Reported by CERTType

SolarWinds Orion API authentication bypass allows remote command execution. Vulnerability also used to install SUPERNOVA malware. Update to specific versions or implement IIS mitigations

Reporter	Title	Published	Views	Family All 29
GithubExploit	Exploit for Missing Authentication for Critical Function in Solarwinds Orion_Platform	29 Dec 202003:17	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Solarwinds Orion_Platform	5 Jan 202113:42	–	githubexploit
Gitee	Exploit for Authentication Bypass Using an Alternate Path or Channel in Solarwinds Orion_Platform	20 Oct 202110:39	–	gitee
ATTACKERKB	CVE-2020-10148 SolarWinds Orion API authentication bypass and RCE	29 Dec 202000:00	–	attackerkb
BDU FSTEC	The vulnerability of the SolarWinds Orion Platform monitoring platform lies in its ability to bypass authentication by using an alternative path or channel, allowing a perpetrator to execute arbitrary code.	20 Jan 202100:00	–	bdu_fstec
Broadcom	BSA-2020-1173	15 Dec 202000:00	–	broadcom
Circl	CVE-2020-10148	28 Dec 202010:40	–	circl
CISA KEV Catalog	SolarWinds Orion Authentication Bypass Vulnerability	3 Nov 202100:00	–	cisa_kev
CNNVD	Solarwinds Orion Platform Authorization Issues Vulnerability	26 Dec 202000:00	–	cnnvd
Check Point Advisories	SolarWinds Orion Platform Authentication Bypass (CVE-2020-10148)	28 Nov 202100:00	–	checkpoint_advisories

Source	Link
solarwinds	www.solarwinds.com/securityadvisory
cyber	www.cyber.dhs.gov/ed/21-01/
us-cert	www.us-cert.cisa.gov/ncas/current-activity/2020/12/13/active-exploitation-solarwinds-software
us-cert	www.us-cert.cisa.gov/ncas/analysis-reports/ar21-027a
github	www.github.com/solarwinds/OrionSDK/wiki
downloads	www.downloads.solarwinds.com/solarwinds/Support/SupernovaMitigation.zip

28 Jan 2021 16:53Current

10High risk

Vulners AI Score10

CVSS 27.5

CVSS 3.19.8

EPSS0.9198

SSVC