CVE-2021-35232: Hard credentials discovered in SolarWinds Web Help Desk which allows to execute Arbitrary Hibernate Queries
First published: Mon Dec 27 2021(Updated: )
Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host machine allows to execute arbitrary HQL queries against the database and leverage the vulnerability to steal the password hashes of the users or insert arbitrary data into the database.
Credit: psirt@solarwinds.com psirt@solarwinds.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SolarWinds WebHelpDesk | <=12.7.6 |
Remedy
SolarWinds advises the customers to upgrade to the latest Web Help Desk 12.7.7 Hotfix 1 product release once it becomes generally available.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-index
- agent/references
- agent/author
- agent/type
- agent/softwarecombine
- agent/weakness
- agent/title
- agent/severity
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/remedy
- agent/description
- agent/first-publish-date
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/solarwinds
- canonical/solarwinds webhelpdesk
- version/solarwinds webhelpdesk/12.7.6