CVE-2021-35233: medium-severity vulnerability in SolarWinds Kiwi Syslog Server
HTTP TRACK & TRACE Methods Enabled
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 1.0%
The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the web server will respond to requests that use these methods by returning exact HTTP request that was received in the response to the client. This may lead to the disclosure of sensitive information such as internal authentication headers appended by reverse proxies.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
SolarWinds · Kiwi Syslog ServerRelated CVEs — SolarWinds Kiwi Syslog Server
In the same product, most dangerous first.