CVE-2021-35248

Summary

It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings.

Affected Software

Weaknesses

• CWE-732: CWE-732 Improper Access Control

Workarounds

If you are unable to upgrade immediately. See SolarWinds Knowledgebase Article Below:

https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-Unrestricted-access-to-Orion-UserSettings-SWIS-entity-for-low-privilege-users-CVE-2021-35248

ADP Enrichment

CVE Program Container

Additional References

• https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35248
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3
• https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm

References

• https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35248
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3
• https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm

• ←Previous
• Next→