Vulnerability · Published Sep 1, 2021 · Assigned by SolarWinds
CVE-2021-35238Stored XSS through URL POST parameter in CreateExternalWebsite Vulnerability
Medium 4.8
In plain English
A medium-severity cross-site scripting in Orion Platform from SolarWinds. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).
Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)1.1%top 35.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SolarWinds | Orion Platform | 2020.2.6 and previous versions – before 2020.2.6 HF1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
References
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm x_refsource_MISC
- https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US x_refsource_MISC
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35238 x_refsource_MISC