title: SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands
description: The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.
problem types: CWE-288 Authentication Bypass Using an Alternate Path or Channel
affected:
{
product: Orion Platform
vendor: SolarWinds
versions:
status: affected, version: 2019.4 HF 5
status: affected, version: 2020.2 without hotfix
status: affected, version: 2020.2 HF 1
}
solutions: Users should update to the relevant versions of the SolarWinds Orion Platform:
2019.4 HF 6 (released December 14, 2020)
2020.2.1 HF 2 (released December 15, 2020)
2019.2 SUPERNOVA Patch (released December 23, 2020)
2018.4 SUPERNOVA Patch (released December 23, 2020)
2018.2 SUPERNOVA Patch (released December 23, 2020)