Vulnerabilitycritical

Another Critical RCE Flaw Discovered in SolarWinds Orion Platform

The Hacker Newsby @TheHackersNewsMar 26, 2021 · 05:07 UTC (Mar 26, 2021)1 min read1 · 1 read

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2020-35856 CVE-2021-3109 CVE-2021-25274 CVE-2021-25275

Tags: cve-2020-35856 cve-2021-3109 cve-2021-25274 cve-2021-25275 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-3109 +1 related CVE CVE-2020-35856	The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context of an administrator account	4.8	<1%		Mar 26, 2021
CVE-2021-25274 +1 related CVE CVE-2021-25275	The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set permissions on its private queues	9.8 group max	36%	PoC	Feb 3, 2021

From the original article

1 min read at thehackernews.com

IT infrastructure management provider SolarWinds on Thursday released a new update to its Orion networking monitoring tool with fixes for four security vulnerabilities, counting two weaknesses that could be exploited by an authenticated attacker to achieve remote code execution (RCE).

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.