« Volver al listado

CVE-2021-35238

Estado: ModificadaMedia (4.8)—

User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Solarwinds — Orion Platform

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-35238",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@solarwinds.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.7
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@solarwinds.com",
      "affectedData": [
        {
          "vendor": "SolarWinds",
          "product": "Orion Platform",
          "versions": [
            {
              "status": "affected",
              "version": "2020.2.6 and previous versions",
              "lessThan": "2020.2.6 HF1",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Windows"
          ]
        }
      ]
    }
  ],
  "published": "2021-09-01T12:15:07.607",
  "references": [
    {
      "url": "https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm",
      "tags": [
        "Product",
        "Vendor Advisory"
      ],
      "source": "psirt@solarwinds.com"
    },
    {
      "url": "https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "psirt@solarwinds.com"
    },
    {
      "url": "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35238",
      "tags": [
        "Broken Link"
      ],
      "source": "psirt@solarwinds.com"
    },
    {
      "url": "https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm",
      "tags": [
        "Product",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35238",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@solarwinds.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website."
    },
    {
      "lang": "es",
      "value": "Un usuario con derechos de Administrador de la Plataforma Orion podría almacenar una vulnerabilidad de tipo XSS mediante el parámetro URL POST en el sitio web CreateExternalWebsite"
    }
  ],
  "lastModified": "2026-06-17T03:57:21.720",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:solarwinds:orion_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "70E2B14D-F48F-4CA2-8995-17F1FC30E091",
              "versionEndIncluding": "2020.2.5"
            },
            {
              "criteria": "cpe:2.3:a:solarwinds:orion_platform:2020.2.6:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD239861-0422-45EE-9A3B-EED4F87F38F7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@solarwinds.com"
}