High severity · published Dec 23, 2021
CVE-2021-35243
The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server (12.7.7 and earlier), allowing users to execute dangerous HTTP requests
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server (12.7.7 and earlier), allowing users to execute dangerous HTTP requests. The HTTP PUT method is normally used to upload data that is saved on the server with a user-supplied URL. While the DELETE method requests that the origin server removes the association between the target resource and its current functionality. Improper use of these methods may lead to a loss of integrity.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WH
Web Help Desk · Solarwinds
through 12.7.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-35243
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-35243
Release Notes
https://support.solarwinds.com/SuccessCenter/s/article/Web-Help-Desk-12-7-7-Hotfix-1-Release-Notes?language=en_US
Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35243
More from Web Help Desk
9.8
CVE-2025-40551
SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
9.8
CVE-2025-40536
SolarWinds Web Help Desk Security Control Bypass Vulnerability
9.8
CVE-2025-26399
SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability
9.8
CVE-2024-28986
SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability
9.1
CVE-2024-28987
SolarWinds Web Help Desk Hardcoded Credential Vulnerability