CVE-2021-35227: Insecure Web Configuration for RabbitMQ Management Plugin in SolarWinds ARM

Q: What is CVE-2021-35227?

CVE-2021-35227 is a vulnerability in the RabbitMQ Plugin in SolarWinds Access Rights Manager (ARM) 2020.2.6 that allows the HTTP interface to be enabled without the ability to configure HTTPS.

Q: How severe is CVE-2021-35227?

CVE-2021-35227 has a severity score of 7.8 (high).

Q: How does CVE-2021-35227 affect SolarWinds Access Rights Manager?

CVE-2021-35227 affects SolarWinds Access Rights Manager (ARM) 2020.2.6 by enabling the HTTP interface without the ability to configure HTTPS.

Q: How can I fix CVE-2021-35227?

To fix CVE-2021-35227, upgrade to a version of SolarWinds Access Rights Manager (ARM) that includes the ability to configure HTTPS for the RabbitMQ Plugin.

Q: Where can I find more information about CVE-2021-35227?

You can find more information about CVE-2021-35227 in the SolarWinds documentation and the SolarWinds Trust Center security advisories.

Published Oct 21, 2021

Updated

The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTPS was not available.

Affected Software

1 affected component

SolarWinds Access Rights Manager<=2020.2.6

Remediation

Information

SolarWinds recommends installing 2021.4 for the ARM as soon as it becomes available.

Event History

Oct 21, 2021

CVE Published

via MITRE·05:41 PM

Data Sourced

via MITRE·05:41 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2021-35227?

CVE-2021-35227 is a vulnerability in the RabbitMQ Plugin in SolarWinds Access Rights Manager (ARM) 2020.2.6 that allows the HTTP interface to be enabled without the ability to configure HTTPS.

How severe is CVE-2021-35227?