CVE-2021-35221

Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.

• CWE-284

• https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmProduct, Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-ImportAlert-Improper-Access-Control-Tampering-Vulnerability-CVE-2021-35221?language=en_USMitigation, Patch, Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_USPatch, Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35221Vendor Advisory
• https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmProduct, Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-ImportAlert-Improper-Access-Control-Tampering-Vulnerability-CVE-2021-35221?language=en_USMitigation, Patch, Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_USPatch, Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35221Vendor Advisory

Published

Aug 31, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35216Insecure Deserialization of untrusted data remote code execu…8.8
• CVE-2021-35217Insecure Deseralization of untrusted data remote code execut…8.8
• CVE-2021-35218Deserialization of Untrusted Data in the Web Console Chart E…8.8
• CVE-2021-35219ExportToPdfCmd Arbitrary File Read Information Disclosure Vu…4.9
• CVE-2021-3522GStreamer before 1.18.4 may perform an out-of-bounds read wh…5.5
• CVE-2021-35220Command Injection vulnerability in EmailWebPage API which ca…7.2
• CVE-2021-35222This vulnerability allows attackers to impersonate users and…9.6
• CVE-2021-35223The Serv-U File Server allows for events such as user login …8.8
• CVE-2021-35225Each authenticated Orion Platform user in a MSP (Managed Ser…6.4
• CVE-2021-35226An entity in Network Configuration Manager product is miscon…6.5
• CVE-2021-35227The HTTP interface was enabled for RabbitMQ Plugin in ARM 20…7.8
• CVE-2021-35228This vulnerability occurred due to missing input sanitizatio…4.7