CVE-2021-35218CWE-502
Chart Endpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability
High · published September 1, 2021
Patch now
High probability of exploitation
CVSS calls it high at 8.9. It sits in the 99.5th percentile for exploit probability.
What it is
Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the Orion Patch Manager Web Console could potentially exploit this and compromise the server
The record
Technical detail
- CVSS v3.1
- 8.9 · HIGH
- Vector
- CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
- CVSS v4.0
- Not supplied
- EPSS
- 0.76411 · 99.5th percentile
- Weakness
- CWE-502 · Deserialization of Untrusted Data
- Published
- 2021-09-01T14:24Z
EPSS history
Timeline