CVE-2021-35246

The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a legitimate user's network traffic could bypass the application's use of SSL/TLS encryption and use the application as a platform for attacks against its users.

• CWE-319
• CWE-319

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35246Third Party Advisory
• https://documentation.solarwinds.com/en/success_center/ets/content/release_notes/ets_2022-4_release_notes.htmRelease Notes, Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35246Patch, Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35246Third Party Advisory
• https://documentation.solarwinds.com/en/success_center/ets/content/release_notes/ets_2022-4_release_notes.htmRelease Notes, Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35246Patch, Vendor Advisory

Published

Nov 23, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3524A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph O…6.5
• CVE-2021-35240A security researcher stored XSS via a Help Server setting. …4.8
• CVE-2021-35242Serv-U server responds with valid CSRFToken when the request…8.8
• CVE-2021-35243The HTTP PUT and DELETE methods were enabled in the Web Help…7.5
• CVE-2021-35244The "Log alert to a file" action within action management en…7.2
• CVE-2021-35245When a user has admin rights in Serv-U Console, the user can…6.8
• CVE-2021-35247Serv-U web login screen to LDAP authentication was allowing …5.3
• CVE-2021-35248It has been reported that any Orion user, e.g. guest account…4.3
• CVE-2021-35249This broken access control vulnerability pertains specifical…4.3
• CVE-2021-3525Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-35250A researcher reported a Directory Transversal Vulnerability …7.5
• CVE-2021-35251Sensitive information could be displayed when a detailed tec…5.3