TI-2021-14126 Aliases CVE-2021-35233 GHSA-rqwr-hf3j-vwq9

HTTP TRACK & TRACE Methods Enabled

LOW 26CWE-16Published 2021-10-27 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the web server will respond to requests that use these methods by returning exact HTTP request that was received in the response to the client. This may lead to the disclosure of sensitive information such as internal authentication headers appended by reverse proxies.

Why it matters now

EPSS 0.0096 61st percentileScored 2026-11-07

Fix Fixed Kiwi Syslog Server (SolarWinds): 9.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SolarWinds	Kiwi Syslog Server	9.7.2 and previous versions to before 9.8	9.8	Patch available	CNA

Kiwi Syslog Server VendorSolarWinds Affected 9.7.2 and previous versions to before 9.8 Fixed in 9.8 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:solarwinds:kiwi_syslog_server::::::::	up to 9.7.2	Vulnerable	SolarWinds

cpe:2.3:a:solarwinds:kiwi_syslog_server:*:*:*:*:*:*:*:* Versions up to 9.7.2 Vulnerable ·SolarWinds

Remediation

Fix · CNA Kiwi Syslog Server (SolarWinds) Fixed in 9.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2021-10-27
SolarWinds Kiwi Syslog Server 9.8
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2021-14128 ASP.NET Debug Feature EnabledPriority LOW 27
- TI-2021-14129 Missing Secure Flag From SSL CookiePriority LOW 25
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2021-35233
2026-10-03 Alias added: GHSA-rqwr-hf3j-vwq9

References

Advisory 2

TI-2021-14124 Unquoted Path (SMB Login) Vulnerability CVSS 3.1MEDIUM 6.7
TI-2021-14128 ASP.NET Debug Feature Enabled CVSS 3.1MEDIUM 5.3
TI-2021-14130 Clickjacking in SolarWinds Kiwi Syslog Server CVSS 3.1MEDIUM 5.0
TI-2021-14129 Missing Secure Flag From SSL Cookie CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences