CVE-2021-35246mediumCWE-319

CVE-2021-35246: falha de média gravidade em SolarWinds Engineer's Toolset

Unprotected Transport of Credentials (HSTS) Vulnerability

Publicada em 23 nov 2022 · Atualizada em 25 abr 2025

Seguir esta CVE + Monitorar Engineer's Toolset

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.4%

The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a legitimate user's network traffic could bypass the application's use of SSL/TLS encryption and use the application as a platform for attacks against its users.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Produtos afetados

SolarWinds · Engineer's Toolset

Referências

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35246 https://documentation.solarwinds.com/en/success_center/ets/content/release_notes/ets_2022-4_release_notes.htm https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35246