Description

Acunetix determined that it was possible to access SolarWinds Orion's sensitive files without authentication with a specially crafted HTTP request.

Remediation

Upgrade to the latest version of SolarWinds Orion

References

SolarWinds Orion API authentication bypass allows remote command execution

Related Vulnerabilities

WordPress Plugin Captcha by BestWebSoft Security Bypass (3.8.7)

WordPress Plugin MStore API-Create Native Android & iOS Apps On The Cloud Security Bypass (3.1.9)

WordPress Plugin All-in-One WP Migration Security Bypass (2.0.4)

WordPress Plugin HandL UTM Grabber Security Bypass (2.6.4)

WordPress Plugin wp-buddha-free-adwords Security Bypass (1.0.0)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Authentication Bypass CWE-287 CVE-2020-10148