VulnerabilityModified
CVE-2021-35215
Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5.
HIGH 8.8EPSS 69.7%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 69.7%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to exploit this vulnerability.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 69.73% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-502
- Affected
- solarwinds/orion platform
- Source
- psirt@solarwinds.com
References
- https://documentation.solarwinds.co/enm/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htmBroken Link
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmProduct, Vendor Advisory
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35215Patch, Vendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-21-1245/Third Party Advisory, VDB Entry
- https://documentation.solarwinds.co/enm/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htmBroken Link
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmProduct, Vendor Advisory
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35215Patch, Vendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-21-1245/Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.