CVE-2021-35234

Опубликовано: 20 дек. 2021

Источник: nvd

CVSS3: 8

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation. An attacker with low-user privileges may steal password hashes and password salt information.

Ссылки

https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm
Product
Vendor Advisory
https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3
Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35234
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1596/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-1597/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-1598/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-1599/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-1600/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-1601/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-1602/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-1603/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-1604/
Third Party Advisory
VDB Entry
https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm
Product
Vendor Advisory
https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3
Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35234
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1596/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-1597/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-1598/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-1599/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-1600/
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:solarwinds:orion_platform:*:*:*:*:*:*:*:*

Версия до 2020.2.5 (включая)

cpe:2.3:a:solarwinds:orion_platform:2020.2.6:-:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix1:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix2:*:*:*:*:*:*

EPSS

Процентиль: 73%

0.00763

Низкий

8 High

CVSS3

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-pw8x-9www-h93w

CVSS3: 8.8

github

около 4 лет назад

EPSS

Процентиль: 73%

0.00763

Низкий

8 High

CVSS3

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-89