The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Orion_platform | Solarwinds | 2019.4-hotfix5 (including) | 2019.4-hotfix5 (including) |
| Orion_platform | Solarwinds | 2020.2 (including) | 2020.2 (including) |
| Orion_platform | Solarwinds | 2020.2.1-hotfix1 (including) | 2020.2.1-hotfix1 (including) |