Insecure Deserialization Of Untrusted Data Causing Remote Code Execution Vulnerability (CVE-2021-35216)

Summary

Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker with network access via HTTP can compromise this vulnerability can result in Remote Code Execution.

Affected Products 

  • Patch Manager 2020.2.5 and earlier

Affected Products

Acknowledgments

  • Jangggggg working with Trend Micro Zero Day Initiative
Advisory Details
Severity
High
Advisory ID

CVE-2021-35216

First Published
07/15/2021
Fixed Version

Patch Manager 2020.2.6

CVSS Score

CVSS:3.0/AV:A/AC:L/PR:L/UI:

N/S:C/C:H/I:H/A:L

Download PDF
Send an Email