Vulnerability · Published Mar 25, 2022 · Assigned by SolarWinds
CVE-2021-35254Authenticated Remote Code Execution in WebHelpDesk 12.7.8
High 8.2
In plain English
A high-severity improper input validation in WebHelpDesk from SolarWinds. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)1.0%top 36.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input field to prevent the misuse of this input in the future.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SolarWinds | WebHelpDesk | 12.7.8 and previous versions – before 12.7.8 HF 1 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N