ZDI-CAN-13460: SolarWinds Orion Network Performance Monitor DisableNOCView SQL Injection Privilege Escalation Vulnerability
This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Orion Network Performance Monitor. Authentication is required to exploit this vulnerability. The specific flaw exists within the DisableNOCView method. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SolarWinds Orion |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of ZDI-CAN-13460?
The severity of ZDI-CAN-13460 is considered high due to the potential for privilege escalation.
How do I fix ZDI-CAN-13460?
To fix ZDI-CAN-13460, ensure that you apply the latest patches and updates from SolarWinds for Orion Network Performance Monitor.
What impact does ZDI-CAN-13460 have on my system?
ZDI-CAN-13460 allows remote attackers to escalate privileges, potentially giving them control over affected installations.
Is authentication required to exploit ZDI-CAN-13460?
Yes, authentication is required to exploit the vulnerability described in ZDI-CAN-13460.
Which software is affected by ZDI-CAN-13460?
The vulnerability ZDI-CAN-13460 affects SolarWinds Orion Network Performance Monitor.
- agent/references
- agent/softwarecombine
- agent/title
- agent/severity
- agent/description
- agent/type
- agent/source
- agent/tags
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-21-1243
- alias/ZDI-CAN-13460
- alias/CVE-2021-35212
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/event
- vendor/solarwinds
- canonical/solarwinds orion