Vulnerability · Published Oct 27, 2021 · Assigned by SolarWinds

CVE-2021-35233HTTP TRACK & TRACE Methods Enabled

Medium 5.3

In plain English

A medium-severity security flaw in Kiwi Syslog Server from SolarWinds. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)1.0%top 38.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the web server will respond to requests that use these methods by returning exact HTTP request that was received in the response to the client. This may lead to the disclosure of sensitive information such as internal authentication headers appended by reverse proxies.

Affected products (as reported)

Vendor	Product	Versions
SolarWinds	Kiwi Syslog Server	9.7.2 and previous versions – before 9.8

Weakness: CWE-16 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm x_refsource_MISC
https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35233 x_refsource_MISC