PT-2021-17362
CVE-2021-27258
·
تاريخ النشر
2021-04-14
·
تاريخ التحديث
2022-07-29
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions:
SolarWinds Orion Platform version 2020.2
Description:
This issue allows remote attackers to escalate privileges on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the "SaveUserSetting" endpoint, resulting from improper restriction of this endpoint to unprivileged users. An attacker can leverage this issue to escalate privileges from Guest to Administrator.
Recommendations:
For SolarWinds Orion Platform version 2020.2, restrict access to the "SaveUserSetting" endpoint to prevent unprivileged users from exploiting this issue. As a temporary workaround, consider disabling the "SaveUserSetting" endpoint until a patch is available.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾