CVE-2020-27870

MEDIUM

SolarWinds Orion Platform 2020.2.1 - Authenticated Path Traversal via ExportToPDF.aspx

Title source: llm
STIX 2.1

Description

This vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Orion Platform 2020.2.1. Authentication is required to exploit this vulnerability. The specific flaw exists within ExportToPDF.aspx. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-11917.

References (1)

Core 1
Core References
Third Party Advisory, VDB Entry x_refsource_misc
https://www.zerodayinitiative.com/advisories/ZDI-21-066/

Scores

CVSS v3 6.5
EPSS 0.0931
EPSS Percentile 92.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-22
Status published
Products (1)
solarwinds/orion_platform 2020.2.1
Published Feb 10, 2021
Tracked Since Feb 18, 2026