CVE-2020-10148 SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands

2020-12-2921:55:16

CWE-288

certcc

www.cve.org

solarwinds

api

authentication

bypass

vulnerability

remote attacker

compromise

instance

orion platform

versions.

AI Score

9.9

Confidence

High

EPSS

0.972

Percentile

99.9%

JSON

The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.

CNA Affected

[
  {
    "product": "Orion Platform",
    "vendor": "SolarWinds",
    "versions": [
      {
        "status": "affected",
        "version": "2019.4 HF 5"
      },
      {
        "status": "affected",
        "version": "2020.2 without hotfix"
      },
      {
        "status": "affected",
        "version": "2020.2 HF 1"
      }
    ]
  }
]