Description
Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation. An attacker with low-user privileges may steal password hashes and password salt information.
CVSS breakdown
CVSS 3.1
Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected products
- SolarWinds / Orion Core2020.2.6 HF 2 and previous versions – 2020.2.6 HF 3
References
- MISChttps://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3
- MISChttps://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm
- VENDOR_ADVISORYhttps://www.solarwinds.com/trust-center/security-advisories/cve-2021-35234
- VENDOR_ADVISORYhttps://www.zerodayinitiative.com/advisories/ZDI-21-1598/
- VENDOR_ADVISORYhttps://www.zerodayinitiative.com/advisories/ZDI-21-1596/
- VENDOR_ADVISORYhttps://www.zerodayinitiative.com/advisories/ZDI-21-1604/
- VENDOR_ADVISORYhttps://www.zerodayinitiative.com/advisories/ZDI-21-1600/
- VENDOR_ADVISORYhttps://www.zerodayinitiative.com/advisories/ZDI-21-1601/
- VENDOR_ADVISORYhttps://www.zerodayinitiative.com/advisories/ZDI-21-1602/
- VENDOR_ADVISORYhttps://www.zerodayinitiative.com/advisories/ZDI-21-1597/
- VENDOR_ADVISORYhttps://www.zerodayinitiative.com/advisories/ZDI-21-1599/
- VENDOR_ADVISORYhttps://www.zerodayinitiative.com/advisories/ZDI-21-1603/