PT-2021-20854 · Solarwinds · Solarwinds Web Help Desk

Shubham Shah · Published 2021-12-27 · Updated 2024-09-17 · CVE-2021-35232

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions: SolarWinds Web Help Desk (affected versions not specified)

Description: A security issue has been discovered in the SolarWinds Web Help Desk product, where hard-coded credentials allow an attacker with local access to the host machine to execute arbitrary HQL queries against the database. This enables the attacker to steal password hashes of users or insert arbitrary data into the database.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2021-35232

Affected Products

Solarwinds Web Help Desk

References · 7

• https://osv.dev/vulnerability/CVE-2021-35232 · Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Web-Help-Desk-12-7-7-Hotfix-1-Release-Notes?language=en_US · Vendor Advisory
• https://solarwinds.com/trust-center/security-advisories/CVE-2021-35232 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35232 · Security Note
• https://t.me/cvenotify/94868 · Telegram Post
• https://t.me/cvenotify/55735 · Telegram Post
• https://t.me/cibsecurity/34694 · Telegram Post