CVE-2021-32076 Vulnerability Details

  /     /     /  

CVE-2021-32076 Metadata Quick Info

CVE Published: 26/08/2021 | CVE Updated: 17/09/2024 | CVE Year: 2021
Source: SolarWinds | Vendor: SolarWinds | Product: Web Help Desk
Status : PUBLISHED

---

CVE-2021-32076 Description

Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the \'Web Help Desk Getting Started Wizard\', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback.

Metrics

CVSS Version: 3.1 | Base Score: 5.3 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* NONE
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* LOW
    Integrity Impact (I)* NONE
    Availability Impact (A)* NONE

Weakness Enumeration (CWE)

CWE-ID: CWE-290
CWE Name: CWE-290 Authentication Bypass by Spoofing
Source: SolarWinds

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).