CVE-2020-10148
SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands
In short
The SolarWinds Orion API allows attackers to bypass authentication and execute commands without proper credentials, potentially compromising the entire monitoring platform. This is a critical flaw because attackers can remotely gain control without needing valid login information.
Technical detail
CWE-288 authentication bypass in SolarWinds Orion API enables unauthenticated remote command execution through API endpoints. The vulnerability affects specific versions (2019.4 HF 5, 2020.2, 2020.2 HF 1) and requires network access to the API; successful exploitation results in full platform compromise and unauthorized administrative control.
Summary generated and translated by AI from the official description.
The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
SolarWinds · Orion Platformpublic PoCs found — 3
githubgithub.com/B1anda0/CVE-2020-10148★ 10githubgithub.com/rdoix/CVE-2020-10148-Solarwinds-Orion★ 5githubgithub.com/horrister/solarwinds-sunburst-cve-2020-10148★ 1⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →