CVE-2021-35244

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Dec 20, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-352456.8When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host maCVE-2021-352465.3The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a legitimate user's neCVE-2021-352475.3Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the inpuCVE-2021-352484.3It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic seCVE-2021-352494.3This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains wCVE-2021-352507.5A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to the Serv-U installatiCVE-2021-352515.3Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental deCVE-2021-352527.5Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is expoCVE-2021-352548.8SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this inputCVE-2021-352619.8File Upload Vulnerability in Yupoxion BearAdmin before commit 10176153528b0a914eb4d726e200fd506b73b075 allows attacker to execute arbitrary CVE-2021-352656.1A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitraCVE-2021-352667.8In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur
CVE-2021-35244: High severity, CVSS 7.2 | Vulnix