CVE-2021-35239

A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink.

• CWE-79
• CWE-79

• https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmProduct, Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-Stored-XSS-in-Maps-text-box-hyperlink-vulnerability-CVE-2021-35239?language=en_USMitigation, Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_USVendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35239Vendor Advisory
• https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmProduct, Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-Stored-XSS-in-Maps-text-box-hyperlink-vulnerability-CVE-2021-35239?language=en_USMitigation, Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_USVendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35239Vendor Advisory

Published

Aug 31, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35233The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog S…5.3
• CVE-2021-35234Numerous exposed dangerous functions within Orion Core has a…8.8
• CVE-2021-35235The ASP.NET debug feature is enabled by default in Kiwi Sysl…5.3
• CVE-2021-35236The Secure flag is not set in the SSL Cookie of Kiwi Syslog …5.3
• CVE-2021-35237A missing HTTP header (X-Frame-Options) in Kiwi Syslog Serve…4.3
• CVE-2021-35238User with Orion Platform Admin Rights could store XSS throug…4.8
• CVE-2021-3524A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph O…6.5
• CVE-2021-35240A security researcher stored XSS via a Help Server setting. …4.8
• CVE-2021-35242Serv-U server responds with valid CSRFToken when the request…8.8
• CVE-2021-35243The HTTP PUT and DELETE methods were enabled in the Web Help…7.5
• CVE-2021-35244The "Log alert to a file" action within action management en…7.2
• CVE-2021-35245When a user has admin rights in Serv-U Console, the user can…6.8