Description

Acunetix determined that it was possible to access SolarWinds Orion's sensitive files without authentication with a specially crafted HTTP request.

Remediation

Upgrade to the latest version of SolarWinds Orion

References

SolarWinds Orion API authentication bypass allows remote command execution

Related Vulnerabilities

WordPress Plugin SecuPress Free-WordPress Security Security Bypass (1.4.13)

Drupal Core 8.8.x Security Bypass (8.8.0 - 8.8.7)

WordPress Plugin User Registration-Custom Registration Form, Login Form And User Profile Security Bypass (2.3.2.1)

WordPress Plugin Thrive Apprentice Security Bypass (2.3.9.3)

Oracle Sun GlassFish/Java System Application Server Remote Authentication Bypass Vulnerability

Severity

High

Classification

CVE-2020-10148 CWE-287 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Authentication Bypass