A vulnerability, which was classified as critical, has been found in SolarWinds Orion Platform up to 2019.4 HF 5/2020.2 HF 1. This issue affects some unknown processing of the component API. The manipulation with an unknown input leads to a authentication bypass vulnerability. Using CWE to declare the problem leads to CWE-288. A product requires authentication, but the product has an alternate path or channel that does not require authentication. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.

The weakness was disclosed 12/30/2020. It is possible to read the advisory at kb.cert.org. The identification of this vulnerability is CVE-2020-10148. Technical details are unknown but an exploit is available.

It is declared as highly functional. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 11/03/2021 with a due date of 05/03/2022:

Apply updates per vendor instructions.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at Zero-Day.cz (597).

Productinfo

Vendor

• SolarWinds

Name

• Orion Platform

Version

• 2019.4 HF 5
• 2020.2 HF 1

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion