CVE-2021-35229

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting vulnerability is present in Database Performance Monitor 2022.1.7779 and previous versions when using a complex SQL query

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SolarWinds	Database Performance Monitor	>= 2022.1.7779 and previous versions, < 2022.1

References

https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2022-2_release_notes.htmRelease Notes, Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35229Vendor Advisory
https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2022-2_release_notes.htmRelease Notes, Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35229Vendor Advisory

Timeline

Published: Apr 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-35237.5A flaw was found in 3Scale APICast in versions prior to 2.11.0, where it incorrectly identified connections for reuse. This flaw allows an a CVE-2021-352306.7As a result of an unquoted service path vulnerability present in the Kiwi CatTools Installation Wizard, a local attacker could gain escalate CVE-2021-352316.7As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain esc CVE-2021-352326.1Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web CVE-2021-352335.3The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only CVE-2021-352348.8Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation. An attacker CVE-2021-352355.3The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions. ASP.NET allows remote debugging of web ap CVE-2021-352365.3The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to on CVE-2021-352374.3A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that CVE-2021-352384.8User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website.CVE-2021-352395.4A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink.CVE-2021-35246.5A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the i