CVE-2021-35248
Assigner: SolarWinds
Published: 2021-12-20T00:00:00
State: PUBLISHED
affected: defaultStatus: unaffected
platforms: Windows
product: Orion 
vendor: SolarWinds
versions: lessThan:  2020.2.6 HF 3 
status: affected
version: 2020.2.6 HF 2 and previous versions 
versionType: custom
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: N/A
datePublic: 2021-12-19T16:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: <p>It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings.</p>
value: It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-732
description: CWE-732 Improper Access Control
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: <p>This vulnerability has been fixed in Orion version 2020.2.6 HF3, customers are advised to upgrade to the latest version once it it is available.</p>
value: This vulnerability has been fixed in Orion version 2020.2.6 HF3, customers are advised to upgrade to the latest version once it it is available.


source: discovery: EXTERNAL
title: Unrestricted access to Orion.UserSettings SWIS entity for low-privilege users
workarounds: supportingMedia: base64: no
type: text/html
value: <p>If you are unable to upgrade immediately. See SolarWinds Knowledgebase Article Below:</p><p>https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-Unrestricted-access-to-Orion-UserSettings-SWIS-entity-for-low-privilege-users-CVE-2021-35248</p>
value: If you are unable to upgrade immediately. See SolarWinds Knowledgebase Article Below:

https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-Unrestricted-access-to-Orion-UserSettings-SWIS-entity-for-low-privilege-users-CVE-2021-35248


x_generator: engine: Vulnogram 0.0.9