Lucene search

SolarWindsCVELIST:CVE-2021-35217

HistorySep 02, 2021 - 12:00 a.m.

CVE-2021-35217 Insecure Deserialization of untrusted data causing Remote code execution vulnerability.

2021-09-0200:00:00

SolarWinds

www.cve.org

8.9 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

9.3 High

AI Score

Confidence

High

0.053 Low

EPSS

Percentile

93.1%

JSON

Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data.

CNA Affected

[
  {
    "product": "Orion Platform ",
    "vendor": "SolarWinds",
    "versions": [
      {
        "lessThan": "2020.2.6",
        "status": "affected",
        "version": "2020.2.5 and previous versions",
        "versionType": "custom"
      }
    ]
  }
]

References

documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm

documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm

www.solarwinds.com/trust-center/security-advisories/cve-2021-35217

www.zerodayinitiative.com/advisories/ZDI-21-1247/

8.9 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

9.3 High

AI Score

Confidence

High

0.053 Low

EPSS

Percentile

93.1%

JSON

Related for CVELIST:CVE-2021-35217