Lucene search

SolarWindsCVE-2021-35232

HistoryDec 27, 2021 - 7:15 p.m.

CVE-2021-35232

2021-12-2719:15:08

CWE-798

SolarWinds

web.nvd.nist.gov

cve-2021-35232

solarwinds

web help desk

hard coded credentials

arbitrary hql queries

database vulnerability

CVSS2

3.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:P/A:N

CVSS3

6.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

AI Score

6.6

Confidence

High

EPSS

Percentile

5.1%

JSON

Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host machine allows to execute arbitrary HQL queries against the database and leverage the vulnerability to steal the password hashes of the users or insert arbitrary data into the database.

Affected configurations

Nvd

Node

solarwindswebhelpdeskRange≤12.7.6

VendorProductVersionCPE
solarwindswebhelpdesk*cpe:2.3:a:solarwinds:webhelpdesk:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
solarwinds	webhelpdesk	*	cpe:2.3:a:solarwinds:webhelpdesk::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Web Help Desk",
    "vendor": "SolarWinds",
    "versions": [
      {
        "lessThan": "12.7.7 HF 1",
        "status": "affected",
        "version": "12.7.7 and previous versions",
        "versionType": "custom"
      }
    ]
  }
]

References

support.solarwinds.com/SuccessCenter/s/article/Web-Help-Desk-12-7-7-Hotfix-1-Release-Notes?language=en_US

www.solarwinds.com/trust-center/security-advisories/CVE-2021-35232

CVSS2

3.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:P/A:N

CVSS3

6.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

AI Score

6.6

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2021-35232