CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-35220 – EmailWebPage Command Injection RCE
https://notcve.org/view.php?id=CVE-2021-35220
Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page. Una vulnerabilidad de Inyección de Comandos en la API de EmailWebPage, que puede conllevar una Ejecución de Código Remota (RCE) desde la página Alerts Settings • https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-EmailWebPage-Command-Injection-RCE-CVE-2021-35220?language=en_US https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35220 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-35219 – ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2021-35219
ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page. Una Vulnerabilidad de Divulgación de Información de Lectura Arbitraria de Archivos en ExportToPdfCmd, mediante la función ImportAlert en la página Alerts Settings • https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-ExportToPdfCmd-Arbitrary-File-Read-Information-Disclosure-CVE-2021-35219?language=en_US https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35219 •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-28674
https://notcve.org/view.php?id=CVE-2021-28674
The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node (outside of the attacker's perimeter) via an account with write permissions. This occurs because node IDs are predictable (with incrementing numbers) and the access control on Services/NodeManagement.asmx/DeleteObjNow is incorrect. To exploit this, an attacker must be authenticated and must have node management rights associated with at least one valid group on the platform. La página de administración de nodos en SolarWinds Orion Platform versiones anteriores a 2020.2.5 HF1, permite a un atacante crear o eliminar un nodo (fuera del perímetro del atacante) por medio de una cuenta con permisos de escritura. Esto ocurre porque los IDs de los nodos son predecibles (con números crecientes) y el control de acceso en Services/NodeManagement.asmx/DeleteObjNow es incorrecto. • https://pastebin.com/zFUd2cCj https://www.solarwinds.com/trust-center/security-advisories/cve-2021-28674 • CWE-330: Use of Insufficiently Random Values CWE-863: Incorrect Authorization •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2021-27258 – SolarWinds Orion Platform NCM SCM IPAM SaveUserSetting Improper Access Control Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-27258
This vulnerability allows remote attackers to execute escalate privileges on affected installations of SolarWinds Orion Platform 2020.2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SaveUserSetting endpoint. The issue results from improper restriction of this endpoint to unprivileged users. An attacker can leverage this vulnerability to escalate privileges their privileges from Guest to Administrator. • https://www.zerodayinitiative.com/advisories/ZDI-21-192 • CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-27277 – SolarWinds Orion Virtual Infrastructure Monitor OneTimeJobSchedulerEventsService Deserialization of Untrusted Data Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-27277
This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Orion Virtual Infrastructure Monitor 2020.2. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the OneTimeJobSchedulerEventsService WCF service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. • https://documentation.solarwinds.com/en/Success_Center/SAM/Content/Release_Notes/SAM_2020-2-5_release_notes.htm#Fixed https://www.zerodayinitiative.com/advisories/ZDI-21-373 • CWE-502: Deserialization of Untrusted Data •