Insecure Deserialization Of Untrusted Data Causing Remote Code Execution Vulnerability 

(CVE-2021-35216)

Download PDF

Summary

Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker with network access via HTTP can compromise this vulnerability can result in Remote Code Execution.

Affected Products 

  • Patch Manager 2020.2.5 and earlier

Affected Products

Acknowledgments

  • Jangggggg working with Trend Micro Zero Day Initiative

Advisory Details

Severity

8.9 High

Advisory ID

First Published

07/15/2021

Fixed Version

Patch Manager 2020.2.6

CVSS Score