CVE-2021-35219

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
SolarWinds	Orion Platform	>= 2020.2.6 and previous versions, <= 2020.2.6 HF1

References

https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmProduct, Release Notes, Vendor Advisory
https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-ExportToPdfCmd-Arbitrary-File-Read-Information-Disclosure-CVE-2021-35219?language=en_USMitigation, Patch, Vendor Advisory
https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_USPatch, Release Notes, Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35219Vendor Advisory
https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmProduct, Release Notes, Vendor Advisory
https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-ExportToPdfCmd-Arbitrary-File-Read-Information-Disclosure-CVE-2021-35219?language=en_USMitigation, Patch, Vendor Advisory
https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_USPatch, Release Notes, Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35219Vendor Advisory

Timeline

Published: Aug 31, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-35225.5GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.CVE-2021-352207.2Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.CVE-2021-352218.1Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts S CVE-2021-352229.6This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Ale CVE-2021-352238.8The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with CVE-2021-352256.4Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all tha CVE-2021-352266.5An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service (SWIS). Ex CVE-2021-352277.8The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTPS was not available.CVE-2021-352284.7This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific sectio CVE-2021-352296.1Cross-site scripting vulnerability is present in Database Performance Monitor 2022.1.7779 and previous versions when using a complex SQL que CVE-2021-35237.5A flaw was found in 3Scale APICast in versions prior to 2.11.0, where it incorrectly identified connections for reuse. This flaw allows an a CVE-2021-352306.7As a result of an unquoted service path vulnerability present in the Kiwi CatTools Installation Wizard, a local attacker could gain escalate