CVE-2021-35225

Description

Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data cross-contamination.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Affected products

SolarWinds / NPM2020.2.6 Hotfix 1 and previous versions – 2020.2.6 Hotfix 2

References

MISChttps://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm
MISChttps://support.solarwinds.com/SuccessCenter/s/article/NPM-2020-2-6-Hotfix-2?language=en_US
VENDOR_ADVISORYhttps://www.solarwinds.com/trust-center/security-advisories/cve-2021-35225