CVE-2021-35218: Chart Endpoint Deserialization of Untrusted Data Remote Code Execution Vuln

Chart Endpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

Status

Published

2021-09-01

Updated

2024-08-04

Assigning organization

SolarWinds

Description

Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the Orion Patch Manager Web Console could potentially exploit this and compromise the server

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SolarWinds Patch Manager

2020.5 and previous versions to < 2020.2.6affected

References

https://documentation.solarwinds.com/en/success_center/patchman/content/release_notes/patchman_2020-2-6_release_notes.htm ↗
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35218 ↗
https://www.zerodayinitiative.com/advisories/ZDI-21-1248/ ↗