CVE-2021-35216 - CVE House

Back to Database

Status published High CVE-2021-35216

Deserialization of Untrusted Data in Resource Controls Remote Code Execution

8.9 CVSS

Vulnerability Description

Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. An Authenticated Attacker with network access via HTTP can compromise this vulnerability can result in Remote Code Execution.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-35216

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Jangggggg working with Trend Micro Zero Day Initiative

References

More from SolarWinds

View All →

SolarWinds Web Help Desk Authentication Bypass Vulnerability

SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability

SolarWinds Web Help Desk Authentication Bypass Vulnerability

SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability

SolarWinds Serv-U Path Restriction Bypass Vulnerability

Affected Vendor

SolarWinds

View all reports →

Affected Software

Patch Manager

Vulnerable Versions:

2020.2.5 and previous versions.

Timeline

Official Publish: September 1st, 2021

Last Modified: August 4th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1068 Exploitation for Privilege Escalation

Privilege Escalation