CVE-2021-35216

Опубликовано: 01 сент. 2021

Источник: nvd

CVSS3: 8.9

CVSS3: 8.8

CVSS2: 9

EPSS Средний

Описание

Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. An Authenticated Attacker with network access via HTTP can compromise this vulnerability can result in Remote Code Execution.

Ссылки

https://documentation.solarwinds.com/en/success_center/patchman/content/release_notes/patchman_2020-2-6_release_notes.htm
Release Notes
Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35216
Patch
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1246/
Third Party Advisory
VDB Entry
https://documentation.solarwinds.com/en/success_center/patchman/content/release_notes/patchman_2020-2-6_release_notes.htm
Release Notes
Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35216
Patch
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1246/
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:solarwinds:patch_manager:*:*:*:*:*:*:*:*

Версия до 2020.2.6 (исключая)

EPSS

Процентиль: 98%

0.51655

Средний

8.9 High

CVSS3

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-502

Связанные уязвимости

GHSA-8475-rfgr-qm88

github

больше 3 лет назад

BDU:2021-06028

CVSS3: 8.9

fstec

больше 4 лет назад

Уязвимость компонента EditResourceControls программного обеспечения управления патчами SolarWinds Patch Manager, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 98%

0.51655

Средний

8.9 High

CVSS3

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-502