Vulnerability · Published Aug 31, 2021 · Assigned by SolarWinds
CVE-2021-35213Orion User setting Improper Access Control Privilege Escalation Vulnerability
High 8.9
In plain English
A high-severity improper access control in Orion Platform from SolarWinds. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities).
Severity (CVSS 3.1)8.9High
Exploit odds (30 days)3.4%top 11.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5. It allows a guest user to elevate privileges to the Administrator using this vulnerability. Authentication is required to exploit the vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SolarWinds | Orion Platform | 2020.2.5 and previous versions – before 2020.2.5 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
References
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm x_refsource_MISC
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm x_refsource_MISC
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35213 x_refsource_MISC
- https://www.zerodayinitiative.com/advisories/ZDI-21-1244/ x_refsource_MISC