CVE-2021-35215highCWE-502

ActionPluginBaseView Deserialization of Untrusted Data RCE

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.9epss 70%

exploitation probability

70%top 1% of all CVEs

observed exploitation

nono source reports it

Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to exploit this vulnerability.

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Affected products

SolarWinds · Orion Platform

References

https://documentation.solarwinds.co/enm/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35215 https://www.zerodayinitiative.com/advisories/ZDI-21-1245/