漏洞描述
SolarWinds Orion API is vulnerable to an authentication bypass vulnerability that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
kb.cert.orghttps://kb.cert.org/vuls/id/843464↗github.comhttps://github.com/jaeles-project/jaeles-signatures/blob/master/cves/solarwinds-lfi-cve-2020-10148.yaml↗gist.github.comhttps://gist.github.com/0xsha/75616ef6f24067c4fb5b320c5dfa4965↗twitter.comhttps://twitter.com/0xsha/status/1343800953946787847↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2020-10148↗