CVE-2021-35243

low-risk
Published 2021-12-23

The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server (12.7.7 and earlier), allowing users to execute dangerous HTTP requests. The HTTP PUT method is normally used to upload data that is saved on the server with a user-supplied URL. While the DELETE method requests that the origin server removes the association between the target resource and its current functionality. Improper use of these methods may lead to a loss of integrity.

Do I need to act?

-
0.63% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.3/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Solarwinds

References (4)

Release Notes https://support.solarwinds.com/SuccessCenter/s/article/Web-Help-Desk-12-7-7-Hotf...
Vendor Advisory https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35243
Release Notes https://support.solarwinds.com/SuccessCenter/s/article/Web-Help-Desk-12-7-7-Hotf...
Vendor Advisory https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35243
28
/ 100
low-risk
Severity 21/34 · High
Exploitability 2/34 · Minimal
Exposure 5/34 · Minimal