CVE-2021-35244

Katalog CVE

CVSS 7.2 · High EPSS 6,0%

Kerentanan Unrestricted Upload of File with Dangerous Type pada solarwinds orion platform. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution.

Rincian

Terbit di NVD

20 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

6,0% peluang dieksploitasi; lebih tinggi dari 93,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm advisory vendor
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3?language=en_US release notes · advisory vendor
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35242 not applicable · advisory vendor
• https://www.zerodayinitiative.com/advisories/ZDI-22-375/ advisory pihak ketiga · vdb entry