Hard credentials discovered in SolarWinds Web Help Desk which allows to execute Arbitrary Hibernate Queries
Priority LOW 30CWE-798Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-798.
Summary
Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host machine allows to execute arbitrary HQL queries against the database and leverage the vulnerability to steal the password hashes of the users or insert arbitrary data into the database.
Why it matters now
EPSS 0.00323 25th percentileScored 2026-11-07
Fix Fixed Web Help Desk (SolarWinds): 12.7.7 HF 1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SolarWinds | Web Help Desk | 12.7.7 and previous versions to before 12.7.7 HF 1 | 12.7.7 HF 1 | Patch available | CNA |
- Web Help Desk VendorSolarWinds Affected 12.7.7 and previous versions to before 12.7.7 HF 1 Fixed in 12.7.7 HF 1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:solarwinds:webhelpdesk:*:*:*:*:*:*:*:* | up to 12.7.6 | Vulnerable | SolarWinds |
- cpe:2.3:a:solarwinds:webhelpdesk:*:*:*:*:*:*:*:* Versions up to 12.7.6 Vulnerable ·SolarWinds
Remediation
- Fix · CNA Web Help Desk (SolarWinds) Fixed in 12.7.7 HF 1
Timeline
- 2026-10-02 Threatist record created from CVE-2021-35232
- 2026-10-03 Alias added: GHSA-34qh-79jp-wj3q
References
More SolarWinds Webhelpdesk vulnerabilities
- TI-2021-14145 Authenticated Remote Code Execution in WebHelpDesk 12.7.8 CVSS 3.1HIGH 8.8
- TI-2019-14429 Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a… CVSS 3.1HIGH 7.8
- TI-2019-12645 SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket. CVSS 3.1MEDIUM 6.5
- TI-2019-12641 SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request. CVSS 3.1MEDIUM 5.4
- TI-2019-12643 SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account. CVSS 3.1MEDIUM 5.4
Sources
- CVE-2021-35232 · CVE Program
- CVE-2021-35232 · NVD
- FIRST EPSS
- GHSA-34qh-79jp-wj3q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences