CVE-2021-35234

Exposed Dangerous Functions - Privileged Escalation

HIGH

8.8

CVSS Score

Published: December 20, 2021 at 08:08 PM UTC

Updated: June 17, 2026 at 03:57 AM UTC

1 product affected across 1 vendorOrion Platform

Using Orion Core by SolarWinds?

Get instant alerts when new vulnerabilities affect Orion Core - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 3%

Description

Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation. An attacker with low-user privileges may steal password hashes and password salt information.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Orion Platform · Solarwinds

95%

v ≤ 2020.2.52020.2.6 HF 2 and previous versions ≤ v < 2020.2.6 HF 32020.2.6 2020.2.6 HF 2 and previous versions 2020.2.6 hotfix1 2020.2.6 hotfix2

Affected range stops below 2020.2.6 HF 3, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (12)

x_refsource_MISCProductVendor Advisory

Source: [email protected]

https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm

x_refsource_MISCVendor Advisory

Source: [email protected]

https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3

x_refsource_MISCVendor Advisory

Source: [email protected]

https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35234