CVE-2020-10148

🗓️ 29 Dec 2020 22:15:12Reported by [email protected]Type

nvd

nvd🔗 web.nvd.nist.gov👁 27 Views

The SolarWinds Orion API is vulnerable to authentication bypass allowing remote attackers to execute API commands

Reporter	Title	Published	Views	Family All 29
GithubExploit	Exploit for Missing Authentication for Critical Function in Solarwinds Orion_Platform	29 Dec 202003:17	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Solarwinds Orion_Platform	5 Jan 202113:42	–	githubexploit
Gitee	Exploit for Authentication Bypass Using an Alternate Path or Channel in Solarwinds Orion_Platform	20 Oct 202110:39	–	gitee
ATTACKERKB	CVE-2020-10148 SolarWinds Orion API authentication bypass and RCE	29 Dec 202000:00	–	attackerkb
BDU FSTEC	The vulnerability of the SolarWinds Orion Platform monitoring platform lies in its ability to bypass authentication by using an alternative path or channel, allowing a perpetrator to execute arbitrary code.	20 Jan 202100:00	–	bdu_fstec
Broadcom	BSA-2020-1173	15 Dec 202000:00	–	broadcom
Circl	CVE-2020-10148	28 Dec 202010:40	–	circl
CISA KEV Catalog	SolarWinds Orion Authentication Bypass Vulnerability	3 Nov 202100:00	–	cisa_kev
CNNVD	Solarwinds Orion Platform Authorization Issues Vulnerability	26 Dec 202000:00	–	cnnvd
Check Point Advisories	SolarWinds Orion Platform Authentication Bypass (CVE-2020-10148)	28 Nov 202100:00	–	checkpoint_advisories

NVD

Node

solarwinds orion_platformMatch2019.4hotfix5

OR

solarwinds orion_platformMatch2020.2-

OR

solarwinds orion_platformMatch2020.2.1hotfix1

Source	Link
kb	www.kb.cert.org/vuls/id/843464
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
solarwinds	www.solarwinds.com/securityadvisory
kb	www.kb.cert.org/vuls/id/843464

24 Oct 2025 14:36Current

9.9High risk

Vulners AI Score9.9

CVSS 27.5

CVSS 3.19.8

EPSS0.94345

CWE-288 CWE-306

solarwinds orion api authentication bypass remote attacker execute api commands compromise instance versions 2019.4 hf 5 2020.2 2020.2 hf 1 cve-2020-10148