CVE-2020-10148
SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands
Basic Information
- CVE State
- PUBLISHED
- Reserved Date
- March 05, 2020
- Published Date
- December 29, 2020
- Last Updated
- September 16, 2024
- Vendor
- SolarWinds
- Product
- Orion Platform
- Description
- The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.
CVSS Scores
SSVC Information
- Exploitation
- active
- Automatable
- Yes
- Technical Impact
- total
Known Exploited Vulnerability Information
| Source | Added Date |
|---|---|
| CISA | 2021-11-03 00:00:00 UTC |
Scanner Integrations
| Scanner | URL | Date Detected |
|---|---|---|
| Nuclei | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10148.yaml | 2025-04-26 00:00:00 UTC |
Potential Proof of Concepts
Warning: These PoCs have not been tested and could contain malware. Use at your own risk.
B1anda0/CVE-2020-10148
Type: github • Created: 2021-01-05 13:42:36 UTC • Stars: 10
SolarWinds Orion API 远程代码执行漏洞批量检测脚本
rdoix/CVE-2020-10148-Solarwinds-Orion
Type: github • Created: 2020-12-29 03:17:56 UTC • Stars: 5