CVE-2021-28674

Katalog CVE

CVSS 5.4 · Medium EPSS 0,91%

Kerentanan Use of Insufficiently Random Values pada solarwinds orion platform. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node (outside of the attacker's perimeter) via an account with write permissions. This occurs because node IDs are predictable (with incrementing numbers) and the access control on Services/NodeManagement.asmx/DeleteObjNow is incorrect. To exploit this, an attacker must be authenticated and must have node management rights associated with at least one valid group on the platform.

Rincian

Terbit di NVD

30 Juli 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-330: Use of Insufficiently Random Values
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,91% peluang dieksploitasi; lebih tinggi dari 58,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-28674 patch · advisory vendor
• https://pastebin.com/zFUd2cCj advisory pihak ketiga