VULNERABILITY INTELLIGENCE

CVE-2021-35232

CVSS score6.8 MEDIUM

EPSS probability0.32%

CISA KEVNot currently listed

Published2021-12-27

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Description

Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host machine allows to execute arbitrary HQL queries against the database and leverage the vulnerability to steal the password hashes of the users or insert arbitrary data into the database.

Weakness classification

CWE-798: Use of Hard-coded Credentials

Primary references

psirt@solarwinds.com — Release Notes, Vendor Advisory
psirt@solarwinds.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory