CVE-2020-27870: 
SolarWinds Platform vulnerability analysis and mitigation

CVE-2020-27870 is a sensitive information disclosure vulnerability affecting SolarWinds Orion Platform version 2020.2.1. The vulnerability was discovered in the ExportToPDF.aspx component and requires authentication to exploit. It was reported on October 14, 2020, and fixed in Orion Platform 2020.2.1 Hot Fix 2 released on December 15, 2020 (ZDI Advisory).

The vulnerability stems from improper validation of user-supplied paths in file operations within the ExportToPDF.aspx component. The flaw has a CVSS v3.1 base score of 6.5 (MEDIUM) according to NVD scoring (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), while Zero Day Initiative rates it at 7.5 (HIGH) with vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) (NVD).

When successfully exploited, this vulnerability allows an authenticated remote attacker to disclose sensitive information in the context of SYSTEM privileges on affected installations of SolarWinds Orion Platform (ZDI Advisory).

The vulnerability requires authentication to exploit and can be triggered through the ExportToPDF.aspx component. The attack vector is network-accessible with low attack complexity (NVD).

The vulnerability was addressed in SolarWinds Orion Platform 2020.2.1 Hot Fix 2, released on December 15, 2020. Users should upgrade to this version or later to mitigate the vulnerability (ZDI Advisory).