---
id: 9039
title: "Advisory: Solarwinds Web Help Desk Arbitrary HQL Evaluation (CVE-2021-35232)"
cve: CVE-2021-35232
source_domain: slcyber.io
source_url: "https://www.slcyber.io/research/advisory-solarwinds-web-help-desk-arbitrary-hql-evaluation-cve-2021-35232"
published_at: "2022-01-23T00:00:00Z"
tags: ["rce", "vulnerability-research", "advisory", "solarwinds", "hql-injection", "cve-2021-35239"]
phying_url: "https://phying.com/item/9039"
lang: en
---

# Advisory: Solarwinds Web Help Desk Arbitrary HQL Evaluation (CVE-2021-35232)

## Summary

A hardcoded credential combined with arbitrary HQL evaluation in SolarWinds Web Help Desk enables unauthenticated RCE.

## Intelligence Metadata

- **Sources:** slcyber.io
- **CVE:** CVE-2021-35232
- **Published:** 2022-01-23T00:00:00Z
- **Original:** https://www.slcyber.io/research/advisory-solarwinds-web-help-desk-arbitrary-hql-evaluation-cve-2021-35232
- **Phying News:** https://phying.com/item/9039