CVE-2021-32076

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-32076
Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/208278 Third Party Advisory VDB Entry
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*
History

25 Jan 2024, 21:34

Type Values Removed Values Added
References () https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076 - () https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076 - Vendor Advisory
CPE cpe:2.3:a:solarwinds:web_help_desk:12.7.2:*:*:*:*:*:*:* cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*

07 Nov 2023, 03:35

Type Values Removed Values Added
References (MISC) https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076 - Broken Link () https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076 -

23 Sep 2021, 12:21

Type Values Removed Values Added
CWE CWE-863 CWE-290
References (MISC) https://exchange.xforce.ibmcloud.com/vulnerabilities/208278 - Third Party Advisory (MISC) https://exchange.xforce.ibmcloud.com/vulnerabilities/208278 - Third Party Advisory, VDB Entry

02 Sep 2021, 14:15

Type Values Removed Values Added
Summary Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the ‘Web Help Desk Getting Started Wizard’, especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback. Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback.

02 Sep 2021, 13:15

Type Values Removed Values Added
Summary Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the “Web Help Desk Getting Started Wizard”, especially the admin account creationpage, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback. Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the ‘Web Help Desk Getting Started Wizard’, especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback.

01 Sep 2021, 14:21

Type Values Removed Values Added
CPE cpe:2.3:a:solarwinds:web_help_desk:12.7.2:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : 5.0
v3 : 5.3
CWE CWE-863
References
  • (MISC) https://exchange.xforce.ibmcloud.com/vulnerabilities/208278 - Third Party Advisory
References (MISC) https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076 - (MISC) https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076 - Broken Link

26 Aug 2021, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2021-08-26 15:15

Updated : 2024-01-25 21:34

NVD link : CVE-2021-32076

Mitre link : CVE-2021-32076

CVE.ORG link : CVE-2021-32076

JSON object : View

Products Affected

solarwinds

  • web_help_desk
CWE
CWE-290

Authentication Bypass by Spoofing