CVE-2021-35244
Unrestricted File Upload Causing Remote Code Execution: Orion Platform 2020.2.6
- State
- Published
- Severity
- 6.8 Medium
- Published
- Dec 20, 2021
- Updated
- Sep 16, 2024
- Reserved
- Jun 22, 2021
Description
The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.8 Medium | CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L | SolarWinds |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Orion PlatformSolarWinds |
|
References
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35242
- https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm
- https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3?language=en_US
- https://www.zerodayinitiative.com/advisories/ZDI-22-375/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.