6.8

CVE-2021-35248

Unrestricted access to Orion.UserSettings SWIS entity for low-privilege users

It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Solarwinds ≫ Orion Platform Version < 2020.2.6
   Microsoft ≫ Windows Version-
Solarwinds ≫ Orion Platform Version2020.2.6 Update-
   Microsoft ≫ Windows Version-
Solarwinds ≫ Orion Platform Version2020.2.6 Updatehotfix1
   Microsoft ≫ Windows Version-
Solarwinds ≫ Orion Platform Version2020.2.6 Updatehotfix2
   Microsoft ≫ Windows Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.89% 0.545
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
psirt@solarwinds.com 6.8 2.3 4
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm
Vendor Advisory
https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3
Vendor Advisory
Release Notes
https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35248
Vendor Advisory