HTTP TRACK & TRACE Methods Enabled
CVE-2021-35233

5.3MEDIUM

Key Information:

Vendor
Solarwinds
Status
Kiwi Syslog Server
Vendor
CVE Published:
19 October 2021

Summary

The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the web server will respond to requests that use these methods by returning exact HTTP request that was received in the response to the client. This may lead to the disclosure of sensitive information such as internal authentication headers appended by reverse proxies.

Affected Version(s)

Kiwi Syslog Server Windows 9.7.2 and previous versions < 9.8

References

https://documentation.solarwinds.com/en/success_center/ks...
x_refsource_MISC
https://www.solarwinds.com/trust-center/security-advisori...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.