CVE-2021-35217

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Sep 8, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-352188.8Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has netwCVE-2021-352194.9ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page.CVE-2021-35225.5GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.CVE-2021-352207.2Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.CVE-2021-352218.1Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts SCVE-2021-352229.6This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the AleCVE-2021-352238.8The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied withCVE-2021-352256.4Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all thaCVE-2021-352266.5An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service (SWIS). ExCVE-2021-352277.8The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTPS was not available.CVE-2021-352284.7This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific sectioCVE-2021-352296.1Cross-site scripting vulnerability is present in Database Performance Monitor 2022.1.7779 and previous versions when using a complex SQL que