CVE-2021-35232 json
Hard credentials discovered in SolarWinds Web Help Desk which allows to execute Arbitrary Hibernate Queries
published 2021-12-27 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-21875
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 25%
- public exploits
- 0
- none known
Summary
Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host machine allows to execute arbitrary HQL queries against the database and leverage the vulnerability to steal the password hashes of the users or insert arbitrary data into the database.
Patch / fix
- SolarWinds Web Help Desk 12.7.7 HF 1
Exploit prediction
0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
| NVD | 2.0 | 3.6 | AV:L/AC:L/Au:N/C:P/I:P/A:N |
Affected products
- SolarWinds Web Help Desk
Classification
- Weakness
-
- CWE-798 Use of Hard-coded Credentials
References
-
solarwinds.com
/trust-center/security-advisories/CVE-2021-35232
vendor-advisory
-
support.solarwinds.com
/SuccessCenter/s/article/Web-Help-Desk-12-7-7-Hotfix-1-Release-Notes?language=en_US
release-notes, vendor-advisory
Sources
- CVE List CVE-2021-35232
- NVD CVE-2021-35232
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.