Description
Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
SolarWinds Orion Platform
2020.2.5 and previous versions to < 2020.2.6affected
References
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm ↗
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm ↗
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35217 ↗
- https://www.zerodayinitiative.com/advisories/ZDI-21-1247/ ↗