Vulnerability · Published Oct 21, 2021 · Assigned by SolarWinds
CVE-2021-35225Netpath Horizontal Privilege Escalation Vulnerability: NPM 2020.2.5
Medium 5.0
In plain English
A medium-severity security flaw in NPM from SolarWinds. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.8%top 41.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data cross-contamination.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SolarWinds | NPM | 2020.2.6 Hotfix 1 and previous versions – before 2020.2.6 Hotfix 2 |
References
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm x_refsource_MISC
- https://support.solarwinds.com/SuccessCenter/s/article/NPM-2020-2-6-Hotfix-2?language=en_US x_refsource_MISC
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35225 x_refsource_MISC