CVE-2021-35244: SolarWinds Orion Platform Unrestricted File Upload Remote Code Execution Vulnerability
First published: Mon Dec 20 2021(Updated: )
The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution.
Credit: psirt@solarwinds.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SolarWinds Orion Platform | <2020.2.6 | |
| SolarWinds Orion Platform | =2020.2.6 | |
| SolarWinds Orion Platform | =2020.2.6-hotfix1 | |
| SolarWinds Orion Platform | =2020.2.6-hotfix2 | |
| Microsoft Windows | ||
Remedy
SolarWinds recommends customers upgrade to the latest version once it becomes generally available.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm
- https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3?language=en_US
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35242
- https://www.zerodayinitiative.com/advisories/ZDI-22-375/
Frequently Asked Questions
What is CVE-2021-35244?
CVE-2021-35244 is a vulnerability that allows remote attackers to execute arbitrary code on SolarWinds Orion Platform.
Is authentication required to exploit CVE-2021-35244?
Yes, authentication is required to exploit CVE-2021-35244.
How severe is CVE-2021-35244?
CVE-2021-35244 has a severity value of 8.8 (high).
Which software versions are affected by CVE-2021-35244?
SolarWinds Orion Platform versions up to 2020.2.6 and hotfixes 2020.2.6-hotfix1 and 2020.2.6-hotfix2 are affected by CVE-2021-35244.
How can I fix CVE-2021-35244?
To fix CVE-2021-35244, apply the necessary patches and updates provided by SolarWinds.
- collector/nvd-index
- agent/type
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/title
- agent/author
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-22-375
- alias/ZDI-CAN-13664
- alias/CVE-2021-35244
- agent/software-canonical-lookup
- vendor/solarwinds
- canonical/solarwinds orion platform
- version/solarwinds orion platform/2020.2.6
- version/solarwinds orion platform/2020.2.6-hotfix1
- version/solarwinds orion platform/2020.2.6-hotfix2
- vendor/microsoft
- canonical/microsoft windows