CVE-2021-35243

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server (12.7.7 and earlier), allowing users to execute dangerous HTTP requests. The HTTP PUT method is normally used to upload data that is saved on the server with a user-supplied URL. While the DELETE method requests that the origin server removes the association between the target resource and its current functionality. Improper use of these methods may lead to a loss of integrity.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-749

Affected software

No affected versions have been published.

Timeline

Published: Dec 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-352447.2The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any CVE-2021-352456.8When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host ma CVE-2021-352465.3The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a legitimate user's ne CVE-2021-352475.3Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the inpu CVE-2021-352484.3It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic se CVE-2021-352494.3This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains w CVE-2021-352507.5A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to the Serv-U installati CVE-2021-352515.3Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental de CVE-2021-352527.5Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is expo CVE-2021-352548.8SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input CVE-2021-352619.8File Upload Vulnerability in Yupoxion BearAdmin before commit 10176153528b0a914eb4d726e200fd506b73b075 allows attacker to execute arbitrary CVE-2021-352656.1A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitra