What is CVE-2021-35220?

CVE-2021-35220 is a high-severity software vulnerability (Command injection) with a CVSS score of 8.1. Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.

Is CVE-2021-35220 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 2%.

What products does CVE-2021-35220 affect?

Tracked products affected include SolarWinds Orion. Check the version you run to see whether it is affected.

How do I fix CVE-2021-35220?

Apply the vendor fix promptly. An official patch or advisory is available. Upgrade affected products to a fixed version.

← All products

CVE-2021-35220

HIGH severity · CVSS 8.1 · Command injection

8.1CVSS HIGH

Summary

Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.

Impact & exploitability

Attack vectorAdjacent

Attack complexityLow

Privileges requiredHigh

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactNone

Exploit probability (EPSS)2%

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Affected products we track (1)

SolarWinds Orion

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Official patch: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm ↗

Additional information

NVD record
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htmPatch
https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-EmailWebPage-Command-Injection-RCE-CVE-2021-35220?language=en_USPatch
https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_USPatch
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35220Advisory