Lucene search

SolarWindsCVE-2021-35233

HistoryOct 27, 2021 - 1:15 a.m.

CVE-2021-35233

2021-10-2701:15:07

CWE-16

SolarWinds

web.nvd.nist.gov

cve-2021-35233

kiwi syslog server

http methods

sensitive information disclosure

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

36.4%

JSON

The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the web server will respond to requests that use these methods by returning exact HTTP request that was received in the response to the client. This may lead to the disclosure of sensitive information such as internal authentication headers appended by reverse proxies.

Affected configurations

Nvd

Node

solarwindskiwi_syslog_serverRange≤9.7.2

VendorProductVersionCPE
solarwindskiwi_syslog_server*cpe:2.3:a:solarwinds:kiwi_syslog_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
solarwinds	kiwi_syslog_server	*	cpe:2.3:a:solarwinds:kiwi_syslog_server::::::::

CNA Affected

[
  {
    "platforms": [
      "Windows"
    ],
    "product": "Kiwi Syslog Server",
    "vendor": "SolarWinds",
    "versions": [
      {
        "lessThan": "9.8",
        "status": "affected",
        "version": "9.7.2 and previous versions",
        "versionType": "custom"
      }
    ]
  }
]

References

documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm

www.solarwinds.com/trust-center/security-advisories/CVE-2021-35233

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

36.4%

JSON

Related for CVE-2021-35233