CVE-2021-35248

It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings.

Score

CVSS 3.1 6.8 Medium

Status

Modified - psirt@solarwinds.com

Published

2021-12-20

Last modified

2024-09-16

Weaknesses

CWE-732

Affected products

• Orion (Solarwinds)
• Orion Platform (Solarwinds)

References

• https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3
• https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35248