CVE-2021-35212
Assigner: SolarWinds
Published: 2021-08-31T17:00:15
State: PUBLISHED
affected: product: Orion Platform
vendor: SolarWinds
versions: lessThan: 2020.2.5 HF1 
status: affected
version: 2020.2.5 and previous versions
versionType: custom
credits: value: SolarWinds would like to thank Anonymous working with Trend Micro Zero Day Initiative for reporting on the issue in a responsible manner. 
descriptions: value: An SQL injection Privilege Escalation Vulnerability was discovered in the Orion Platform reported by the ZDI Team. A blind Boolean SQL injection which could lead to full read/write over the Orion database content including the Orion certificate for any authenticated user.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 8.9
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
version: 3.1
problemTypes: descriptions: description: Blind SQL injection Vulnerability  
type: text
solutions: value: SolarWinds has identified a fix for this vulnerability and included the fix in Orion Platform 2020.2.5 Hotfix 1 and, In addition, backported the fixes to Orion Platform 2019.4.2 and 2019.2 HF4,respectively. 

source: defect: CVE-2021-35212
discovery: UNKNOWN
title: Blind SQL injection Vulnerability  
x_generator: engine: Vulnogram 0.0.9