CVE-2021-31475: SolarWinds Orion Job Scheduler JobRouterService Improper Authorization Remote Code Execution Vulnerability
First published: Fri May 21 2021(Updated: )
This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Job Scheduler 2020.2.1 HF 2. Authentication is required to exploit this vulnerability. The specific flaw exists within the JobRouterService WCF service. The issue is due to the WCF service configuration, which allows a critical resource to be accessed by unprivileged users. An attacker can leverage this vulnerability to execute code in the context of an administrator. Was ZDI-CAN-12007.
Credit: zdi-disclosures@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SolarWinds Orion Job Scheduler | ||
| SolarWinds Orion Job Scheduler | =2020.2.1-hotfix2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-31475?
CVE-2021-31475 has been assigned a high severity rating due to the potential for remote code execution.
How do I fix CVE-2021-31475?
To remediate CVE-2021-31475, ensure that you update SolarWinds Orion Job Scheduler to version 2020.2.1 Hotfix 3 or later.
Who is affected by CVE-2021-31475?
CVE-2021-31475 affects installations of SolarWinds Orion Job Scheduler version 2020.2.1 Hotfix 2.
What type of attack is possible with CVE-2021-31475?
CVE-2021-31475 allows remote attackers to execute arbitrary code on affected systems after authentication.
Is authentication required to exploit CVE-2021-31475?
Yes, authentication is required to exploit CVE-2021-31475.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/severity
- agent/author
- agent/weakness
- agent/description
- agent/first-publish-date
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-21-605
- alias/ZDI-CAN-12007
- alias/CVE-2021-31475
- agent/software-canonical-lookup
- agent/event
- agent/trending
- agent/tags
- agent/source
- vendor/solarwinds
- canonical/solarwinds orion job scheduler
- version/solarwinds orion job scheduler/2020.2.1-hotfix2