CVE-2021-35217: SolarWinds Patch Manager WSAsyncExecuteTasks Deserialization of Untrusted Data Remote Code Execution Vulnerability
First published: Wed Sep 08 2021(Updated: )
Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data.
Credit: psirt@solarwinds.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SolarWinds Patch Manager | <=2020.2.5 | |
Remedy
SolarWinds recommends upgrading to both the latest version of Patch Manager and Orion Integration Module as soon as it becomes available.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35217
- https://www.zerodayinitiative.com/advisories/ZDI-21-1247/
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm
Frequently Asked Questions
What is the severity of CVE-2021-35217?
The severity of CVE-2021-35217 is high with a CVSS score of 8.8.
How does CVE-2021-35217 impact SolarWinds Patch Manager?
CVE-2021-35217 allows remote attackers to execute arbitrary code on affected installations of SolarWinds Patch Manager.
Is authentication required to exploit CVE-2021-35217?
Yes, authentication is required to exploit CVE-2021-35217.
What is the specific flaw in CVE-2021-35217?
The specific flaw in CVE-2021-35217 exists within the WSAsyncExecuteTasks endpoint due to the lack of proper validation.
How can I fix CVE-2021-35217 in SolarWinds Patch Manager?
To fix CVE-2021-35217 in SolarWinds Patch Manager, it is recommended to apply the latest security patches and updates provided by SolarWinds.
- collector/nvd-index
- agent/references
- agent/type
- agent/remedy
- agent/title
- agent/author
- agent/severity
- agent/weakness
- agent/softwarecombine
- agent/description
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-21-1247
- alias/ZDI-CAN-14156
- alias/CVE-2021-35217
- agent/software-canonical-lookup
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/last-modified-date
- agent/event
- agent/trending
- vendor/solarwinds
- canonical/solarwinds patch manager
- version/solarwinds patch manager/2020.2.5