Vulnerability · Published Oct 21, 2021 · Assigned by SolarWinds
CVE-2021-35228Reflected cross site scripting affecting SolarWinds: DPA 2021.3.7388
Medium 5.5
In plain English
A medium-severity security flaw in SolarWinds from SolarWinds. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.6%top 52.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific section of page causing a reflective cross site scripting attack. An attacker would need to perform a Man in the Middle attack in order to change header for a remote victim.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SolarWinds | SolarWinds | DPA 2021.3.7388 – before 2021.3.7388 |