CVE-2021-35254
Authenticated Remote Code Execution in WebHelpDesk 12.7.8
HIGH
8.8
CVSS Score
Published: March 25, 2022 at 06:02 PM UTC
Updated: June 17, 2026 at 03:57 AM UTC
1 product affected across 1 vendorWeb Help Desk
Using WebHelpDesk by SolarWinds?
Get instant alerts when new vulnerabilities affect WebHelpDesk - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
HIGH8.8
Exploit prediction
EPSS 1%
Description
SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input field to prevent the misuse of this input in the future.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Affected range stops below 12.7.8, so it looks safe — our inference, not a vendor statement
Affected range stops below 12.7.8 HF 1, so it looks safe — our inference, not a vendor statement
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (2)
x_refsource_MISCMitigationRelease NotesVendor Advisory
Source: [email protected]
https://support.solarwinds.com/SuccessCenter/s/article/Web-Help-Desk-12-7-8-Hotfix-1-Release-Notes?language=en_USx_refsource_MISCPatchVendor Advisory
Source: [email protected]
https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35254CVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- HIGH
- Availability
- HIGH
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-20NVD-CWE-Other
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card