CVE-2021-35238

User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website.

• CWE-79
• CWE-79

• https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmProduct, Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_USMitigation, Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35238Broken Link
• https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmProduct, Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_USMitigation, Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35238Broken Link

Published

Sep 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35232Hard coded credentials discovered in SolarWinds Web Help Des…6.1
• CVE-2021-35233The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog S…5.3
• CVE-2021-35234Numerous exposed dangerous functions within Orion Core has a…8.8
• CVE-2021-35235The ASP.NET debug feature is enabled by default in Kiwi Sysl…5.3
• CVE-2021-35236The Secure flag is not set in the SSL Cookie of Kiwi Syslog …5.3
• CVE-2021-35237A missing HTTP header (X-Frame-Options) in Kiwi Syslog Serve…4.3
• CVE-2021-35239A security researcher found a user with Orion map manage rig…5.4
• CVE-2021-3524A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph O…6.5
• CVE-2021-35240A security researcher stored XSS via a Help Server setting. …4.8
• CVE-2021-35242Serv-U server responds with valid CSRFToken when the request…8.8
• CVE-2021-35243The HTTP PUT and DELETE methods were enabled in the Web Help…7.5
• CVE-2021-35244The "Log alert to a file" action within action management en…7.2