Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
SolarWinds Orion API Auth bypass (CVE-2020-10148) - Vulnerability Database

SolarWinds Orion API Auth bypass (CVE-2020-10148)

Description

Invicti determined that it was possible to access SolarWinds Orion's sensitive files without authentication with a specially crafted HTTP request.

Remediation

Upgrade to the latest version of SolarWinds Orion

References

SolarWinds Orion API authentication bypass allows remote command execution

Related Vulnerabilities

Microsoft ASP.NET Forms authentication bypass High
Common tags: Authentication Bypass
WordPress Plugin Thrive Headline Optimizer Security Bypass (1.3.7.2) High
Common tags: Authentication Bypass
WordPress Plugin Ultimate GDPR & CCPA Compliance Toolkit for WordPress Security Bypass (2.4) High
Common tags: Authentication Bypass
WordPress Plugin BuddyPress Multiple Security Bypass Vulnerabilities (7.2.0) High
Common tags: Authentication Bypass
WordPress Plugin Controlled Admin Access Security Bypass (1.4.0) High
Common tags: Authentication Bypass

Severity

High

Classification

CVE-2020-10148
CWE-287
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Authentication Bypass