CVEvulnerability
CVE-2021-32076
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-08-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-290
Description
Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback.
Affected configurations
• solarwinds web help desk (<= 12.7.2)
Related
Weakness · CWE (1)
- CWE-290 Authentication Bypass by Spoofing weakness
References
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/208278 Third Party Advisory, VDB Entry
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076 Vendor Advisory