CVE-2021-35240

MEDIUM 4.8CVE-2021-35240 · Published 31/08/2021 · updated 17/06/2026

In short

CVE-2021-35240 is a MEDIUM (CVSS 4.8) vulnerability affecting orion platform (solarwinds).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 65.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
orion platform solarwinds	`≤ 2020.2.5`	No fix yet

Description

A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'.

References

documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm · Product
support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-Stored-XSS-via-Help-Server-setting-CVE-2021-35240 · Patch
support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1 · Mitigation
solarwinds.com/trust-center/security-advisories/cve-2021-35240 · Vendor Advisory

More vulnerabilities in orion platform

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

orion platform

solarwinds

≤ 2020.2.5

No fix yet

More vulnerabilities in orion platform

See all →