CVE-2021-35249

Katalog CVE

CVSS 4.3 · Medium EPSS 0,74%

Kerentanan Improper Access Control pada solarwinds serv-u. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should not have access to. Please note the admin is unable to modify the data (read only operation). This UAC issue leads to a data leak to unauthorized users for a domain, with no log of them accessing the data unless they attempt to modify it. This read-only activity is logged to the original domain and does not specify which domain was accessed.

Rincian

Terbit di NVD

17 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,74% peluang dieksploitasi; lebih tinggi dari 53,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3-1_release_notes.... release notes · advisory vendor
• https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35249 advisory vendor