CVE-2021-35243

The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server (12.7.7 and earlier), allowing users to execute dangerous HTTP requests. The HTTP PUT method is normally used to upload data that is saved on the server with a user-supplied URL. While the DELETE method requests that the origin server removes the association between the target resource and its current functionality. Improper use of these methods may lead to a loss of integrity.

• CWE-749

• https://support.solarwinds.com/SuccessCenter/s/article/Web-Help-Desk-12-7-7-Hotfix-1-Release-Notes?language=en_USRelease Notes, Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35243Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Web-Help-Desk-12-7-7-Hotfix-1-Release-Notes?language=en_USRelease Notes, Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35243Vendor Advisory

Published

Dec 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35237A missing HTTP header (X-Frame-Options) in Kiwi Syslog Serve…4.3
• CVE-2021-35238User with Orion Platform Admin Rights could store XSS throug…4.8
• CVE-2021-35239A security researcher found a user with Orion map manage rig…5.4
• CVE-2021-3524A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph O…6.5
• CVE-2021-35240A security researcher stored XSS via a Help Server setting. …4.8
• CVE-2021-35242Serv-U server responds with valid CSRFToken when the request…8.8
• CVE-2021-35244The "Log alert to a file" action within action management en…7.2
• CVE-2021-35245When a user has admin rights in Serv-U Console, the user can…6.8
• CVE-2021-35246The application fails to prevent users from connecting to it…5.3
• CVE-2021-35247Serv-U web login screen to LDAP authentication was allowing …5.3
• CVE-2021-35248It has been reported that any Orion user, e.g. guest account…4.3
• CVE-2021-35249This broken access control vulnerability pertains specifical…4.3