Lucene search

SolarWindsCVELIST:CVE-2021-35231

HistoryOct 19, 2021 - 12:00 a.m.

CVE-2021-35231 Unquoted Path (SMB Login) Vulnerability

2021-10-1900:00:00

CWE-428

SolarWinds

www.cve.org

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain escalated privileges by inserting an executable into the path of the affected service or uninstall entry. Example vulnerable path: “Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Kiwi Syslog Server\Parameters\Application”.

CNA Affected

[
  {
    "product": "Kiwi Syslog Server",
    "vendor": "SolarWinds",
    "versions": [
      {
        "lessThan": "9.8",
        "status": "affected",
        "version": "9.7.2 and previous versions ",
        "versionType": "custom"
      }
    ]
  }
]

References

documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm

www.solarwinds.com/trust-center/security-advisories/cve-2021-35231

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVELIST:CVE-2021-35231