What’s Vulnerable › Vulnerabilities

CVE-2021-35244: Unrestricted File Upload Causing Remote Code Execution: Orion Platform 2020.2.6

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-12-20 · updated 2026-06-17
• Weakness: CWE-434

Description

The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution.

Affected products

• SolarWinds Orion Platform: before 2020.2.6; 2020.2.6, 2020.2.6-hotfix1, 2020.2.6-hotfix2 — fixed in 2020.2.6

How to fix

Upgrade to a fixed version: SolarWinds Orion Platform 2020.2.6. Check the vendor advisory for mitigations.

References

• https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3?language=en_US
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35242
• https://www.zerodayinitiative.com/advisories/ZDI-22-375/
• https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3?language=en_US
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35242
• https://www.zerodayinitiative.com/advisories/ZDI-22-375/

Get alerted when CVE-2021-35244 or the next vulnerability affects your stack