CVE-2021-35225
Assigner: SolarWinds
Published: 2021-10-21T00:00:00
State: PUBLISHED
affected: platforms: Windows
product: NPM
vendor: SolarWinds
versions: lessThan: 2020.2.6 Hotfix 2 
status: affected
version: 2020.2.6 Hotfix 1 and previous versions 
versionType: custom
credits: value: SolarWinds would like to thank Preston Deason, Chad Larson, and Zachary Riezenman for reporting on the issue in a responsible manner
datePublic: 2021-10-21T00:00:00
descriptions: value: Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data cross-contamination.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
version: 3.1
problemTypes: descriptions: description: Netpath Horizontal Privilege Escalation Vulnerability: NPM 2020.2.5
type: text
solutions: value: SolarWinds recommends upgrading to the latest version of Network Performance Monitor 2020.2.6 Hotfix 2 as soon as it becomes available.  All customers should review and implement all of the recommendations from the Orion Secure Configuration Guide
source: discovery: UNKNOWN
title: Netpath Horizontal Privilege Escalation Vulnerability: NPM 2020.2.5
workarounds: value: In the mentioned workaround, Customers can restrict the viewing of access rights for non-admin users via Orion UI. \nhttps://support.solarwinds.com/SuccessCenter/s/article/Orion-NPM-NetPath-account-limitations?language=en_US 
x_generator: engine: Vulnogram 0.0.9