title: Insecure Deserialization of untrusted data causing Remote code execution vulnerability.
description: Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data.
problem types: Insecure Deserialization of untrusted data causing Remote code execution vulnerability.
affected:
{
product: Orion Platform
vendor: SolarWinds
versions:
lessThan: 2020.2.6, status: affected, version: 2020.2.5 and previous versions, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 8.9
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
version: 3.1
]
solutions: SolarWinds  recommends  upgrading  to  both  the  latest  version  of Patch Manager and Orion Integration Module as soon as it becomes available.