How severe is CVE-2020-27870?

CVE-2020-27870 has a severity level of 7.5, which is considered high.

How can CVE-2020-27870 be exploited?

To exploit CVE-2020-27870, remote attackers need authentication and exploit the lack of proper validation in ExportToPDF.aspx.

What software is affected by CVE-2020-27870?

The SolarWinds Orion Platform version 2020.2.1 is affected by CVE-2020-27870.

How can I fix CVE-2020-27870?

To fix CVE-2020-27870, users should apply the necessary security patches or updates provided by SolarWinds.

Vulnerability/
CVE-2020-27870

high

7.5

CWE

10/2/2021

4/8/2024

CVE-2020-27870: SolarWinds Orion Platform ExportToPDF Directory Traversal Information Disclosure Vulnerability

First published: Wed Feb 10 2021(Updated: )

This vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Orion Platform 2020.2.1. Authentication is required to exploit this vulnerability. The specific flaw exists within ExportToPDF.aspx. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-11917.

Credit: zdi-disclosures@trendmicro.com

Affected Software	Affected Version	How to fix
SolarWinds Orion Platform	=2020.2.1
SolarWinds Orion Platform

Never miss a vulnerability like this again

Reference Links

https://www.zerodayinitiative.com/advisories/ZDI-21-066/

Frequently Asked Questions

What is CVE-2020-27870?
CVE-2020-27870 is a vulnerability that allows remote attackers to disclose sensitive information on affected installations of SolarWinds Orion Platform 2020.2.1.
How severe is CVE-2020-27870?
CVE-2020-27870 has a severity level of 7.5, which is considered high.
How can CVE-2020-27870 be exploited?
To exploit CVE-2020-27870, remote attackers need authentication and exploit the lack of proper validation in ExportToPDF.aspx.
What software is affected by CVE-2020-27870?
The SolarWinds Orion Platform version 2020.2.1 is affected by CVE-2020-27870.
How can I fix CVE-2020-27870?
To fix CVE-2020-27870, users should apply the necessary security patches or updates provided by SolarWinds.

collector/nvd-index
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/severity
agent/title
agent/weakness
agent/references
agent/author
agent/last-modified-date
agent/tags
agent/first-publish-date
agent/event
agent/description
collector/zdi-advisory
source/ZDI
alias/ZDI-21-066
alias/ZDI-CAN-11917
alias/CVE-2020-27870
agent/software-canonical-lookup
vendor/solarwinds
canonical/solarwinds orion platform
version/solarwinds orion platform/2020.2.1

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.