CVE-2020-35856

—

CVSS 3.1

4.8 medium

EPSS

<1%p52

Published

Mar 26, 2021 (Mar 26, 2021)

Modified

Jun 17, 2026

Description

SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page.

Vendors: solarwinds
Products: orion platform
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news2 stories

Solarwinds Orion Platform updates fix two remote code execution issues

Security AffairsMar 26, 14:37 UTC · Mar 26, 2021Vulnerability CVE-2021-3109 CVE-2020-35856

60

Another Critical RCE Flaw Discovered in SolarWinds Orion Platform

The Hacker NewsMar 26, 05:07 UTC · Mar 26, 2021Vulnerability CVE-2020-35856 CVE-2021-3109 CVE-2021-25274+1 CVEs

60