CVE-2020-10148 SolarWinds Orion Authentication Bypass

What is CVE-2020-10148?

CVE-2020-10148 is a critical authentication bypass vulnerability in SolarWinds Orion Platform, published on 29 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.

Weakness: CWE-306, CWE-288

Which versions are affected by CVE-2020-10148?

It affects 1 product.

Products include Solarwinds Orion Platform.

How do I fix CVE-2020-10148?

No fix has been published for CVE-2020-10148 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2020-10148 being exploited?

Yes. Attackers have exploited CVE-2020-10148 in the wild since at least 3 Nov 2021.

Public exploit code: 1 Nuclei template and 3 proofs of concept on GitHub.

Other vulnerabilities in SolarWinds Orion Platform

• CVE-2021-27258 Privilege escalation in Orion Platform Critical 9.8
• CVE-2021-25274 Deserialization in n/a Critical 9.8
• CVE-2019-9546 Privilege escalation in n/a Critical 9.8
• CVE-2020-13169 Cross-site scripting in n/a Critical 9.0
• CVE-2021-35215 ActionPluginBaseView Deserialization of Untrusted Data RCE High 8.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7c8f-5r89-mjgx.