CVE-2021-35244 | BDVDB-2026-166172 Detail
SolarWindsOrion Platform
Description#
The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact low, availability impact low. Attack vector: adjacent.
Weaknesses#
No weakness recorded in the source data.
References#
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35242
- https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm
- https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3?language=en_US
- https://www.zerodayinitiative.com/advisories/ZDI-22-375/
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.