This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page.

The version of SolarWinds Orion Platform installed on the remote host is prior to 2020.2.6 HF1. It is, therefore, affected by multiple vulnerabilities as referenced in the orion_platform_2020_2_6_hf1 advisory.

  - A security researcher found a user with Orion map manage rights could store XSS through via text box     hyperlink. (CVE-2021-35239)

  - A security researcher stored XSS via a Help Server setting. This affects customers using Internet     Explorer, because they do not support 'rel=noopener'. (CVE-2021-35240)

  - Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code     Execution (RCE) from the Alerts Settings page. (CVE-2021-35221)

  - User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite     website. (CVE-2021-35238)

  - ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within     the Alerts Settings page. (CVE-2021-35219)

  - This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote     Code Execution (RCE) from the Alerts Settings page. (CVE-2021-35222)

  - Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from     the Alerts Settings page. (CVE-2021-35220)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of SolarWinds Orion Platform is prior to 2020.2.6 HF1. It is, therefore, affected by multiple vulnerabilities:

  - A command injection vulnerability in the EmailWebPage API. An authenticated,     remote attacker can exploit this to execute arbitrary     commands.(CVE-2021-35220)   
  - An arbitrary file read vulnerability in ExportToPdfCmd. An authenticated,     remote attacker can exploit this to read arbitrary files and disclose     sensitive information. (CVE-2021-35219)   
  - An improper access control tampering vulnerability. An authenticated, remote     attacker can exploit this to add arbitrary SMTP servers to the server     configuration. (CVE-2021-35221)   
  - Multiple stored cross-site scripting vulnerabilities. A cross-site scripting     (XSS) vulnerability exists due to improper validation of user-supplied input     before returning it to users. An unauthenticated, remote attacker can exploit     this, by convincing a user visit a URL, to execute arbitrary script code in a     user's browser session. (CVE-2021-35238, CVE-2021-35239, CVE-2021-35240)   
  - A reflected cross-site scripting vulnerability. A cross-site scripting (XSS)     vulnerability exists due to improper validation of user-supplied input before     returning it to users. An unauthenticated, remote attacker can exploit this,     by convincing a user to click a specially crafted URL, to execute arbitrary     script code in a user's browser session. (CVE-2021-35222)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

ID	Name	Product	Family	Type	Severity
155443	SolarWinds Orion Platform 2020.2.0 < 2020.2.6 HF1 Multiple Vulnerabilities XSS	Nessus	CGI abuses	Combined	critical
154339	SolarWinds Orion Platform < 2020.2.6 HF1 Multiple Vulnerabilities	Nessus	CGI abuses	Combined	critical

Detections

Analytics

CVE-2021-35222

critical

Tenable Plugins

critical

critical