PT-2021-17362 · Solarwinds · Solarwinds Orion Platform

Chudypb + 1 · Published 2021-04-14 · Updated 2022-07-29 · CVE-2021-27258

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SolarWinds Orion Platform version 2020.2

Description: This issue allows remote attackers to escalate privileges on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the "SaveUserSetting" endpoint, resulting from improper restriction of this endpoint to unprivileged users. An attacker can leverage this issue to escalate privileges from Guest to Administrator.

Recommendations: For SolarWinds Orion Platform version 2020.2, restrict access to the "SaveUserSetting" endpoint to prevent unprivileged users from exploiting this issue. As a temporary workaround, consider disabling the "SaveUserSetting" endpoint until a patch is available.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2021-27258

ZDI-21-192

Affected Products

Solarwinds Orion Platform

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-27258 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-192 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27258 · Vendor Advisory
• https://t.me/cvenotify/13535 · Telegram Post