SolarWinds Releases Security Updates for Orion

Threat ID:: CC-3799
Threat Severity:: Information only
Published:: 26 March 2021 12:02 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Affected platforms

The following platforms are known to be affected:

SolarWinds Orion Platform Versions: all prior to 2020.2.5

Threat details

Introduction

SolarWinds has released security updates to address four vulnerabilities in Orion. Two of these vulnerabilities could be exploited to achieve remote code execution (RCE). An attacker could exploit some of these vulnerabilities to take control of an affected system.

Remediation advice

Organisations are encouraged to review the release notes for Orion Platform version 2020.2.5 Release Notes and apply the relevant updates.

CVE Vulnerabilities

Status Published

CVE-2021-3109

A Reverse Tabnabbing and Open Redirect vulnerability was found in the custom menu item options page by a security researcher. This vulnerability requires an Orion administrator account to exploit this.

Status Published

CVE-2020-35856

A stored XSS vulnerability was found in the add custom tab within customize view page by a security researcher. This vulnerability requires Orion administrator account to exploit this.

Last edited: 26 March 2021 12:44 pm