high8.9
CVE-2021-35212
An SQL injection Privilege Escalation Vulnerability was discovered in the Orion Platform reported by the ZDI Team.
Impact
An SQL injection Privilege Escalation Vulnerability was discovered in the Orion Platform reported by the ZDI Team. A blind Boolean SQL injection which could lead to full read/write over the Orion database content including the Orion certificate for any authenticated user.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Solarwinds | Orion Platform | Versions 2019.2, 2019.4, 2020.2.1, 2020.2.4, 2020.2.5 |
Weakness classification
References
- NVD record
- CVE.org record
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35212
- https://www.zerodayinitiative.com/advisories/ZDI-21-1243/
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35212
- https://www.zerodayinitiative.com/advisories/ZDI-21-1243/