CVE-2021-35246

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a legitimate user's network traffic could bypass the application's use of SSL/TLS encryption and use the application as a platform for attacks against its users.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
SolarWinds	Engineer's Toolset	2022.3 and previous versions

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35246Third Party Advisory
https://documentation.solarwinds.com/en/success_center/ets/content/release_notes/ets_2022-4_release_notes.htmRelease Notes, Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35246Patch, Vendor Advisory
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35246Third Party Advisory
https://documentation.solarwinds.com/en/success_center/ets/content/release_notes/ets_2022-4_release_notes.htmRelease Notes, Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35246Patch, Vendor Advisory

Timeline

Published: Nov 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-352475.3Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the inpu CVE-2021-352484.3It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic se CVE-2021-352494.3This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains w CVE-2021-352507.5A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to the Serv-U installati CVE-2021-352515.3Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental de CVE-2021-352527.5Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is expo CVE-2021-352548.8SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input CVE-2021-352619.8File Upload Vulnerability in Yupoxion BearAdmin before commit 10176153528b0a914eb4d726e200fd506b73b075 allows attacker to execute arbitrary CVE-2021-352656.1A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitra CVE-2021-352667.8In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur CVE-2021-352677.8NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and MFTMirror allowing for code execu CVE-2021-352687.8In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a heap buffer overflow