CVE-2021-35249
Medium
Description
This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should not have access to. Please note the admin is unable to modify the data (read only operation). This UAC issue leads to a data leak to unauthorized users for a domain, with no log of them accessing the data unless they attempt to modify it. This read-only activity is logged to the original domain and does not specify which domain was accessed.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Solarwinds Serv-u
PublishedMay 17, 2022
First seenMay 17, 2022
Weakness typeCWE-284Improper access control
How to fix
Update
- solarwinds serv-u15.3.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| solarwinds serv-u | v < 15.3.1 | 15.3.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.