CVE-2021-35217 | BDVDB-2026-160519 Detail
SolarWindsOrion Platform
Description#
Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact low. Attack vector: adjacent.
Weaknesses#
No weakness recorded in the source data.
References#
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35217
- https://www.zerodayinitiative.com/advisories/ZDI-21-1247/
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.