First published: Tue Aug 31 2021(Updated: )
A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'.
Credit: psirt@solarwinds.com
Affected Software | Affected Version | How to fix |
---|---|---|
SolarWinds Orion Platform | <=2020.2.5 | |
Microsoft Internet Explorer |
SolarWinds recommends installing 2020.2.6 Hotfix 1 for the Orion Platform as soon as it becomes available. All customers should implement all the recommendations from the Orion Secure Configuration Guide.
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The severity of CVE-2021-35240 is medium with a CVSS score of 4.8.
CVE-2021-35240 affects SolarWinds Orion Platform versions up to and including 2020.2.5.
Internet Explorer is vulnerable to CVE-2021-35240 because it does not support 'rel=noopener'.
To mitigate the stored XSS vulnerability in SolarWinds Orion Platform, apply the Orion Platform 2020.2.6 Hotfix 1 or follow the secure configuration guidelines provided by SolarWinds.
You can find more information about CVE-2021-35240 on the SolarWinds documentation and support centers.