CVE-2020-14005 — HIGH (8.8)

Vulnerability Description

Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows remote attackers to execute arbitrary code via a defined event.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Solarwinds	Orion Network Performance Monitor	2019.4
Solarwinds	Orion Web Performance Monitor	2019.4.1

References

https://gist.github.com/alert3/c9dcce5474e55f408c93c086c30cdbb7Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-063/Third Party AdvisoryVDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-065/Third Party AdvisoryVDB Entry
https://gist.github.com/alert3/c9dcce5474e55f408c93c086c30cdbb7Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-063/Third Party AdvisoryVDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-065/Third Party AdvisoryVDB Entry

FAQ

What is CVE-2020-14005?

CVE-2020-14005 is a vulnerability with a CVSS score of 8.8 (HIGH). Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows remote attackers to execute arbitrary code via a defined event.

How severe is CVE-2020-14005?

CVE-2020-14005 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-14005?

Check the references section above for vendor advisories and patch information. Affected products include: Solarwinds Orion Network Performance Monitor, Solarwinds Orion Web Performance Monitor.