CVEvulnerability
CVE-2021-35217
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-09-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.9 HIGH — CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-502
Description
Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data.
Affected configurations
• solarwinds patch manager (<= 2020.2.5)
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm Vendor Advisory
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm Release Notes, Vendor Advisory
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35217 Vendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-21-1247/ Third Party Advisory, VDB Entry
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm Vendor Advisory
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm Release Notes, Vendor Advisory
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35217 Vendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-21-1247/ Third Party Advisory, VDB Entry