{"id":"CVE-2021-35232","published":"2021-12-27T18:48:18Z","modified":"2024-09-17T03:44:02Z","title":"Hard credentials discovered in SolarWinds Web Help Desk which allows to execute Arbitrary Hibernate Queries","vendor":"SolarWinds","product":"Web Help Desk","tier":"core","eol":null,"affectedVersions":[{"vendor":"SolarWinds","product":"Web Help Desk","versions":[">= 12.7.7 and previous versions, < 12.7.7 HF 1"]}],"description":{"text":"Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host machine allows to execute arbitrary HQL queries against the database and leverage the vulnerability to steal the password hashes of the users or insert arbitrary data into the database.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":6.8,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00323,"percentile":0.25264,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-07-29","exploitedFirstSeen":"2025-07-29","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-29&host_type=src&vulnerability=cve-2021-35232","date":"2025-07-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-30&host_type=src&vulnerability=cve-2021-35232","date":"2025-07-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-08-11&host_type=src&vulnerability=cve-2021-35232","date":"2025-08-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-08-12&host_type=src&vulnerability=cve-2021-35232","date":"2025-08-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-08-13&host_type=src&vulnerability=cve-2021-35232","date":"2025-08-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-08-26&host_type=src&vulnerability=cve-2021-35232","date":"2025-08-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-08-27&host_type=src&vulnerability=cve-2021-35232","date":"2025-08-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-08-28&host_type=src&vulnerability=cve-2021-35232","date":"2025-08-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-08-29&host_type=src&vulnerability=cve-2021-35232","date":"2025-08-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-08-30&host_type=src&vulnerability=cve-2021-35232","date":"2025-08-30"}],"evidenceTotal":15,"provenance":"source"},"exploited":true,"otx":{"pulseCount":4,"pulses":[{"name":"SCANID: S-KhOoOrXsco8: Thor Lite Linux 64 - Sample Lab Device 2 - incomplete (not enriched)","url":"https://otx.alienvault.com/pulse/67c6bb5aa601e91b1314ff44","created":"2025-03-04"},{"name":"Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files","url":"https://otx.alienvault.com/pulse/664cc3c1938ed0b9abf026a2","created":"2024-05-21"},{"name":"Proof Point Emerging Exploit list","url":"https://otx.alienvault.com/pulse/6399fdc966948f6b537b9762","created":"2022-12-14"},{"name":"SolarWinds Warns of Attacks Targeting Web Help Desk Instances; Advises Removing it from Public Infrastructure","url":"https://otx.alienvault.com/pulse/623827d256465459f941b04d","created":"2022-03-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-798","name":"Use of Hard-coded Credentials"}],"references":[{"url":"https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35232","tags":["x_refsource_MISC"]},{"url":"https://support.solarwinds.com/SuccessCenter/s/article/Web-Help-Desk-12-7-7-Hotfix-1-Release-Notes?language=en_US","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-21875","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-21875","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-12-27","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-35232","provenance":"source"},{"date":"2025-07-29","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-29&host_type=src&vulnerability=cve-2021-35232","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":46.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 457 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":5.05,"detail":"percentile 0.2526"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.59,"detail":"4 pulses"},{"name":"CVSS severity","points":4.76,"detail":"base score 6.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-solarwinds-web-help-desk-cwe-798"}}