Riskcovery

CVE-2021-35232

Hard credentials discovered in SolarWinds Web Help Desk which allows to execute Arbitrary Hibernate Queries

State
Published
Severity
6.8 Medium
Published
Dec 27, 2021
Updated
Sep 17, 2024
Reserved
Jun 22, 2021

Read the record on cve.org

Description

Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host machine allows to execute arbitrary HQL queries against the database and leverage the vulnerability to steal the password hashes of the users or insert arbitrary data into the database.

Scores

CVSSScoreVectorSource
3.16.8 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NSolarWinds

Weaknesses

  • CWE-798 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

ProductVersions
Web Help DeskSolarWinds
  • 12.7.7 and previous versions to before 12.7.7 HF 1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.