Vulnerabilities fixed in SolarWinds Orion

SolarWinds has fixed multiple vulnerabilities in the Orion Platform. An authenticated remote malicious party could potentially exploit the vulnerabilities potentially exploit them to execute execute arbitrary code. In addition, vulnerabilities have been fixed that allow a Tabnabbing attack and...

CVE-2020-35856

SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page...

CVE-2021-3109

The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context of an administrator account...

CVE-2021-3109

The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context of an administrator account...

CVE-2020-35856

SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page...

Cross site scripting

SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page...

SolarWinds Orion Platform Reverse Tabnabbing and Open Redirect — CVE-2021-3109

The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context of an administrator account...

CVE-2020-35856

SolarWinds Orion Platform ≤ 2020.2.4 is affected by CVE-2020-35856, a stored cross-site scripting (XSS) vulnerability that exists on the Customize View page and requires an Orion administrator account to exploit. The issue is associated with the add custom tab within the Customize View page, enab...

CVE-2020-35856

SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page...

CVE-2021-3109

CVE-2021-3109 affects SolarWinds Orion Platform; the issue is a Reverse Tabnabbing and open redirect vulnerability in the custom menu item options page that exists before version 2020.2.5. Exploitation requires an Orion administrator account and access is via the custom menu item options page. Th...

Solarwinds Orion Platform 安全漏洞

SolarWinds Orion Platform is a comprehensive bandwidth performance management and fault management application that lets you view real-time statistics about your network directly from your Web browser. A reverse label phishing vulnerability exists in the Customize Menu Item Options page in...

SolarWinds Orion Platform < 2020.2.5 Multiple Vulnerabilities

According to its self-reported version number, the version of SolarWinds Orion Platform is prior to 2020.2.5. It is, therefore, affected by multiple vulnerabilities: - A reverse tabnabbing and open redirect vulnerability was found in the custom menu item options page. This vulnerability requires ...

Solarwinds Orion Platform 跨站脚本漏洞

SolarWinds Orion Platform is a comprehensive bandwidth performance management and fault management application that lets you view real-time statistics about your network directly from your Web browser. A stored cross-site scripting vulnerability exists in SolarWinds Orion Platform versions prior ...

CVE-2020-27871

This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within...

CVE-2020-27871

CVE-2020-27871 affects SolarWinds Orion Platform 2020.2.1, describing an Arbitrary File Write via VulnerabilitySettings.aspx caused by insufficient validation of a user-supplied path in file operations. The vulnerability allows remote attackers to create arbitrary files and, per sources, could en...

CVE-2020-27871

This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within...

CVE-2020-27870

SolarWinds Orion Platform 2020.2.1 is affected by a path-traversal vulnerability in ExportToPDF.aspx. The issue stems from insufficient validation of a user-supplied path before file operations, enabling an authenticated attacker to disclose information in the SYSTEM context. Mitigation: SolarWin...

CVE-2020-27870

This vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Orion Platform 2020.2.1. Authentication is required to exploit this vulnerability. The specific flaw exists within ExportToPDF.aspx. The issue results from the lack of proper...

Solarwinds SolarWinds Orion Platform 路径遍历漏洞

SolarWinds Orion Platform is a network fault and network performance management platform from SolarWinds, Inc. The platform provides real-time monitoring and analysis of network devices and supports a customizable web interface, multiple user opinions, and a mapped view of the entire network. A...

SolarWinds Orion Platform < 2019.4.2 Remote Code Execution

The Collector Service in SolarWinds Orion Platform before 2019.4.2 uses MSMQ Microsoft Message Queue and doesn't set permissions on its private queues. As a result, remote unauthenticated clients can send messages to TCP port 1801 that the Collector Service will process. Additionally, upon...