CVE-2021-35234

Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation. An attacker with low-user privileges may steal password hashes and password salt information.

• CWE-89
• CWE-89

• https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htmProduct, Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35234Vendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-21-1596/Third Party Advisory, VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-21-1597/Third Party Advisory, VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-21-1598/Third Party Advisory, VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-21-1599/Third Party Advisory, VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-21-1600/Third Party Advisory, VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-21-1601/Third Party Advisory, VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-21-1602/Third Party Advisory, VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-21-1603/Third Party Advisory, VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-21-1604/Third Party Advisory, VDB Entry
• https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htmProduct, Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35234Vendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-21-1596/Third Party Advisory, VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-21-1597/Third Party Advisory, VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-21-1598/Third Party Advisory, VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-21-1599/Third Party Advisory, VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-21-1600/Third Party Advisory, VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-21-1601/Third Party Advisory, VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-21-1602/Third Party Advisory, VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-21-1603/Third Party Advisory, VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-21-1604/Third Party Advisory, VDB Entry

Published

Dec 20, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35229Cross-site scripting vulnerability is present in Database Pe…6.1
• CVE-2021-3523A flaw was found in 3Scale APICast in versions prior to 2.11…7.5
• CVE-2021-35230As a result of an unquoted service path vulnerability presen…6.7
• CVE-2021-35231As a result of an unquoted service path vulnerability presen…6.7
• CVE-2021-35232Hard coded credentials discovered in SolarWinds Web Help Des…6.1
• CVE-2021-35233The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog S…5.3
• CVE-2021-35235The ASP.NET debug feature is enabled by default in Kiwi Sysl…5.3
• CVE-2021-35236The Secure flag is not set in the SSL Cookie of Kiwi Syslog …5.3
• CVE-2021-35237A missing HTTP header (X-Frame-Options) in Kiwi Syslog Serve…4.3
• CVE-2021-35238User with Orion Platform Admin Rights could store XSS throug…4.8
• CVE-2021-35239A security researcher found a user with Orion map manage rig…5.4
• CVE-2021-3524A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph O…6.5