by Kastro
Paper/Archive/CVE-2021-35222

CVE-2021-35222

SolarWinds Orion Platform — Resource.aspx Reflected Cross-Site Scripting Vulnerability

EPSS 3%CVSS 9.6
critical.is priorityof 100
46
CVSS 9.6 (NVD)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 85.4.854 × 2017.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page.

Affected

ProductAffectedFixed inSource
Orion Platform2020.2.6 and previous versions – < 2020.2.6 HF12020.2.6 HF1CNA

Scores by source

NVD9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
SolarWinds (CNA)8.0CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L

References

refdocumentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmrefsupport.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_USrefsolarwinds.com/trust-center/security-advisories/cve-2021-35222refsupport.solarwinds.com/SuccessCenter/s/article/Mitigate-the-Resource-aspx-Reflected-Cross-Site-Scripting-Vulnerability-CVE-2021-35222?language=en_US