CVE-2021-35248

Description

It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings.

Affected Platforms

Weakness Type

CWE-732, CWE-732

References

• https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/cor…
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-H…
• https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35248
• https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/cor…
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-H…
• https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35248