CVE-2021-35238

MEDIUM

SolarWinds Orion Platform < 2020.2.5 - Authenticated Stored Cross-Site Scripting via CreateExternalWebsite URL Parameter

Title source: llm

User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website.

Core 3

Core References

Product, Vendor Advisory x_refsource_misc

Mitigation, Vendor Advisory x_refsource_misc

Broken Link x_refsource_misc

CVSS v3 4.8

EPSS 0.0052

EPSS Percentile 67.1%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

CWE

CWE-79

Status published

Products (2)

solarwinds/orion_platform 2020.2.6

solarwinds/orion_platform < 2020.2.5

Published Sep 01, 2021

Tracked Since Feb 18, 2026