CVE-2021-35244

The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution.

• CWE-434

• https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htmVendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3?language=en_USRelease Notes, Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35242Not Applicable, Vendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-22-375/Third Party Advisory, VDB Entry
• https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htmVendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3?language=en_USRelease Notes, Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35242Not Applicable, Vendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-22-375/Third Party Advisory, VDB Entry

Published

Dec 20, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35238User with Orion Platform Admin Rights could store XSS throug…4.8
• CVE-2021-35239A security researcher found a user with Orion map manage rig…5.4
• CVE-2021-3524A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph O…6.5
• CVE-2021-35240A security researcher stored XSS via a Help Server setting. …4.8
• CVE-2021-35242Serv-U server responds with valid CSRFToken when the request…8.8
• CVE-2021-35243The HTTP PUT and DELETE methods were enabled in the Web Help…7.5
• CVE-2021-35245When a user has admin rights in Serv-U Console, the user can…6.8
• CVE-2021-35246The application fails to prevent users from connecting to it…5.3
• CVE-2021-35247Serv-U web login screen to LDAP authentication was allowing …5.3
• CVE-2021-35248It has been reported that any Orion user, e.g. guest account…4.3
• CVE-2021-35249This broken access control vulnerability pertains specifical…4.3
• CVE-2021-3525Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…