Vulnerabilities > CVE-2021-35216 - Deserialization of Untrusted Data vulnerability in Solarwinds Patch Manager

CVSS 9.0 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

SINGLE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

network

low complexity

solarwinds

CWE-502

critical

NVD

Published: 2021-09-01

Updated: 2021-11-03

Summary

Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. An Authenticated Attacker with network access via HTTP can compromise this vulnerability can result in Remote Code Execution.

Vulnerable Configurations

Part	Description	Count
Application	Solarwinds Solarwinds Patch Manager 2.1.2 Solarwinds Patch Manager 2.1.3 Solarwinds Patch Manager 2.1.4 Solarwinds Patch Manager 2.1.5 Solarwinds Patch Manager 2.1.6 Solarwinds Patch Manager 2.1.7 Solarwinds Patch Manager 2019.4 Solarwinds Patch Manager 2019.4.2 Solarwinds Patch Manager 2020.2 Solarwinds Patch Manager 2020.2.1 Solarwinds Patch Manager 2020.2.4 Solarwinds Patch Manager 2020.2.5	12

Common Weakness Enumeration (CWE)

CWE-502 - Deserialization of Untrusted Data

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References