CVE-2021-35222

This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page.

• CWE-79
• CWE-79

• https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmVendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-Resource-aspx-Reflected-Cross-Site-Scripting-Vulnerability-CVE-2021-35222?language=en_USMitigation, Patch, Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_USPatch, Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35222Vendor Advisory
• https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmVendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-Resource-aspx-Reflected-Cross-Site-Scripting-Vulnerability-CVE-2021-35222?language=en_USMitigation, Patch, Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_USPatch, Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35222Vendor Advisory

Published

Aug 31, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35217Insecure Deseralization of untrusted data remote code execut…8.8
• CVE-2021-35218Deserialization of Untrusted Data in the Web Console Chart E…8.8
• CVE-2021-35219ExportToPdfCmd Arbitrary File Read Information Disclosure Vu…4.9
• CVE-2021-3522GStreamer before 1.18.4 may perform an out-of-bounds read wh…5.5
• CVE-2021-35220Command Injection vulnerability in EmailWebPage API which ca…7.2
• CVE-2021-35221Improper Access Control Tampering Vulnerability using Import…8.1
• CVE-2021-35223The Serv-U File Server allows for events such as user login …8.8
• CVE-2021-35225Each authenticated Orion Platform user in a MSP (Managed Ser…6.4
• CVE-2021-35226An entity in Network Configuration Manager product is miscon…6.5
• CVE-2021-35227The HTTP interface was enabled for RabbitMQ Plugin in ARM 20…7.8
• CVE-2021-35228This vulnerability occurred due to missing input sanitizatio…4.7
• CVE-2021-35229Cross-site scripting vulnerability is present in Database Pe…6.1