Domain Admin Broken Access Control
CVE-2021-35249

4.3MEDIUM

Key Information:

Vendor
Solarwinds
Status
Serv-u
Vendor
CVE Published:
17 May 2022

Summary

This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should not have access to. Please note the admin is unable to modify the data (read only operation). This UAC issue leads to a data leak to unauthorized users for a domain, with no log of them accessing the data unless they attempt to modify it. This read-only activity is logged to the original domain and does not specify which domain was accessed.

Affected Version(s)

Serv-U 15.3 and previous versions < 15.3.1

References

https://www.solarwinds.com/trust-center/security-advisori...
x_refsource_MISC
https://documentation.solarwinds.com/en/success_center/se...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.