CVE-2021-35237

A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a button or link, to another server in which they have an identical webpage. The attacker essentially hijacks the user activity intended for the original server and sends them to the other server. This is an attack on both the user and the server.

• CWE-1021
• CWE-1021

• https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htmRelease Notes, Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35237Vendor Advisory
• https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htmRelease Notes, Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35237Vendor Advisory

Published

Oct 29, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35231As a result of an unquoted service path vulnerability presen…6.7
• CVE-2021-35232Hard coded credentials discovered in SolarWinds Web Help Des…6.1
• CVE-2021-35233The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog S…5.3
• CVE-2021-35234Numerous exposed dangerous functions within Orion Core has a…8.8
• CVE-2021-35235The ASP.NET debug feature is enabled by default in Kiwi Sysl…5.3
• CVE-2021-35236The Secure flag is not set in the SSL Cookie of Kiwi Syslog …5.3
• CVE-2021-35238User with Orion Platform Admin Rights could store XSS throug…4.8
• CVE-2021-35239A security researcher found a user with Orion map manage rig…5.4
• CVE-2021-3524A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph O…6.5
• CVE-2021-35240A security researcher stored XSS via a Help Server setting. …4.8
• CVE-2021-35242Serv-U server responds with valid CSRFToken when the request…8.8
• CVE-2021-35243The HTTP PUT and DELETE methods were enabled in the Web Help…7.5