Read the docs
TI-2021-14135 Aliases CVE-2021-35243GHSA-cj38-v3pg-8cgq

HTTP PUT & DELETE Methods Enabled

Priority LOW 35CWE-749Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server (12.7.7 and earlier), allowing users to execute dangerous HTTP requests. The HTTP PUT method is normally used to upload data that is saved on the server with a user-supplied URL. While the DELETE method requests that the origin server removes the association between the target resource and its current functionality. Improper use of these methods may lead to a loss of integrity.

Why it matters now

EPSS 0.0093 60th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SolarWindsWeb Help Desk12.7.7 and previous versions 12.7.7 HF1—No fix listedCNA
  • Web Help Desk VendorSolarWinds Affected 12.7.7 and previous versions 12.7.7 HF1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*up to 12.7.7VulnerableSolarWinds
  • cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:* Versions up to 12.7.7 Vulnerable ·SolarWinds

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-35243
  2. 2026-10-03 Alias added: GHSA-cj38-v3pg-8cgq

References

Advisory 2

  • TI-2025-27044 SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-27034 SolarWinds Web Help Desk Security Control Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-19358 SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-19175 SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-19176 SolarWinds Web Help Desk Hardcoded Credential Vulnerability KEVCVSS 3.1CRITICAL 9.1
  • TI-2025-27046 SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences