Actively exploited · Published Dec 29, 2020 · Assigned by certcc
CVE-2020-10148SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands
Critical 9.8 Exploited
In plain English
A critical-severity authentication bypass in Orion Platform from SolarWinds. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 92.0% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SolarWinds | Orion Platform | 2019.4 HF 52020.2 without hotfix2020.2 HF 1 |
Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.solarwinds.com/securityadvisory x_refsource_CONFIRM
- VU#843464 third-party-advisory, x_refsource_CERT-VN
- https://www.kb.cert.org/vuls/id/843464
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10148 government-resource