CVE-2021-31475

· HIGHModified

← All CVEs

CVSS v3.1

8.8

EPSS

6.49%

Published

May 21, 2021

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Job Scheduler 2020.2.1 HF 2. Authentication is required to exploit this vulnerability. The specific flaw exists within the JobRouterService WCF service. The issue is due to the WCF service configuration, which allows a critical resource to be accessed by unprivileged users. An attacker can leverage this vulnerability to execute code in the context of an administrator. Was ZDI-CAN-12007.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-732

Affected Products (1)

solarwinds · orion_job_schedulervulnerable

References (4)

https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-5_release_notes.htm

Release NotesVendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-21-605/

Third Party AdvisoryVDB Entry

https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-5_release_notes.htm

Release NotesVendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-21-605/

Third Party AdvisoryVDB Entry

KEV Catalog EPSS Scores Vendors All CVEs