Description (CNA)
It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| SolarWinds / Orion | affected 2020.2.6 HF 2 and previous versions before 2020.2.6 HF 3 |
CWE
CWE-732
References
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35248
- https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3
- https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm
ADP enrichment
No English description supplied.