CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-35856
https://notcve.org/view.php?id=CVE-2020-35856
SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page. SolarWinds Orion Platform versiones anteriores a 2020.2.5, permite ataques de tipo XSS almacenado por un administrador en la página Customize View. • https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/Release_Notes/Orion_Platform_2020-2-5_release_notes.htm https://support.solarwinds.com/SuccessCenter/s • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2021-3109
https://notcve.org/view.php?id=CVE-2021-3109
The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context of an administrator account. La página de opciones de elementos de menú personalizado en SolarWinds Orion Platform versiones anteriores a 2020.2.5, permite Tabnabbing inverso en el contexto de una cuenta de administrador. • https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/Release_Notes/Orion_Platform_2020-2-5_release_notes.htm https://support.solarwinds.com/SuccessCenter/s •
CVSS: 9.0EPSS: 30%CPEs: 1EXPL: 0CVE-2020-27871 – SolarWinds Orion Platform NCM VulnerabilitySettings Directory Traversal Arbitrary File Creation Vulnerability
https://notcve.org/view.php?id=CVE-2020-27871
This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within VulnerabilitySettings.aspx. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute arbitrary code in the context of SYSTEM. • https://www.zerodayinitiative.com/advisories/ZDI-21-067 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 0CVE-2020-27870 – SolarWinds Orion Platform ExportToPDF Directory Traversal Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-27870
This vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Orion Platform 2020.2.1. Authentication is required to exploit this vulnerability. The specific flaw exists within ExportToPDF.aspx. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. • https://www.zerodayinitiative.com/advisories/ZDI-21-066 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 5%CPEs: 1EXPL: 1CVE-2021-25274
https://notcve.org/view.php?id=CVE-2021-25274
The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set permissions on its private queues. As a result, remote unauthenticated clients can send messages to TCP port 1801 that the Collector Service will process. Additionally, upon processing of such messages, the service deserializes them in insecure manner, allowing remote arbitrary code execution as LocalSystem. El Collector Service en SolarWinds Orion Platform versiones anteriores a 2020.2.4 usa MSMQ (Microsoft Message Queue) y no establece permisos en sus queues privadas. Como resultado, unos clientes no autenticados remotos pueden enviar mensajes hacia el puerto TCP 1801 que el Collector Service procesará. • https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/full-system-control-with-new-solarwinds-orion-based-and-serv-u-ftp-vulnerabilities • CWE-502: Deserialization of Untrusted Data •