What is CVE-2021-35212?

CVE-2021-35212 is a high-severity vulnerability in Solarwinds Orion Platform, classified under SQL Injection. CVSS score: 8.9/10. Published 2021-08-31.

How severe is CVE-2021-35212?

High severity. CVSS v3 base score is 8.9 out of 10.

SQL Injection in Solarwinds Orion Platform

CVE-2021-35212

An SQL injection Privilege Escalation Vulnerability was discovered in the Orion Platform reported by the ZDI Team. A blind Boolean SQL injection which could lead to full read/write over the Orion database content including the Orion certif…

Vulnerability class: SQL Injection

EPSS: 0.016 (73.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.9 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L.

Affected products

Solarwinds Orion Platform — versions 2020.2.5 and previous versions
Solarwinds Orion_platform — versions 2019.2, 2019.4, 2020.2.1

Weakness classification (CWE)

CWE-89 — SQL Injection

References

psirt@solarwinds.com (x_refsource_MISC, Vendor Advisory)
psirt@solarwinds.com (x_refsource_MISC, Release Notes, Vendor Advisory)
psirt@solarwinds.com (Patch, x_refsource_MISC, Vendor Advisory)
psirt@solarwinds.com (VDB Entry, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-35212?: CVE-2021-35212 is a high-severity vulnerability in Solarwinds Orion Platform, classified under SQL Injection. CVSS score: 8.9/10. Published 2021-08-31.
How severe is CVE-2021-35212?: High severity. CVSS v3 base score is 8.9 out of 10.