CVE-2021-35244
Unrestricted File Upload Causing Remote Code Execution: Orion Platform 2020.2.6
The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Unrestricted File Upload Causing Remote Code Execution: Orion Platform 2020.2.6
The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution.
- Record
CVE-2021-35244- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L - Updated
- 2026-11-02
EUVDEUVD-2021-21887
The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution.
- Record
EUVD-2021-21887- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j7c8-fmh5-w5pf
The "Log alert to a file" action within action management enables any Orion Platform user with...
The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution.
- Record
GHSA-j7c8-fmh5-w5pf- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-434
- Updated
- 2026-11-02
NVD
The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution.
- Record
CVE-2021-35244- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L - CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 8.5 High
AV:N/AC:M/Au:S/C:C/I:C/A:C - Weakness
- CWE-434
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-35244 is a medium vulnerability (CVSS 6.8) in Solarwinds Orion Platform, published December 20, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.96%, the 93rd percentile. No source names a fixed version.
References
solarwinds.com/trust-center/security-advisories/cve-2021-35242
documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm
support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3?language=en_US
zerodayinitiative.com/advisories/ZDI-22-375
nvd.nist.gov/vuln/detail/CVE-2021-35244
github.com/advisories/GHSA-j7c8-fmh5-w5pf