CVE-2021-27258: SolarWinds Orion Platform NCM SCM IPAM SaveUserSetting Improper Access Control Privilege Escalation Vulnerability

Published Apr 14, 2021

Updated

This vulnerability allows remote attackers to execute escalate privileges on affected installations of SolarWinds Orion Platform 2020.2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SaveUserSetting endpoint. The issue results from improper restriction of this endpoint to unprivileged users. An attacker can leverage this vulnerability to escalate privileges their privileges from Guest to Administrator. Was ZDI-CAN-11903.

Other sources

This vulnerability allows remote attackers to execute escalate privileges on affected installations of SolarWinds Orion Platform. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SaveUserSetting endpoint. The issue results from improper restriction of this endpoint to unprivileged users. An attacker can leverage this vulnerability to escalate privileges their privileges from Guest to Administrator.

Affected Software

2 affected components

SolarWinds Orion Platform

SolarWinds Orion Platform=2020.2

Event History

Apr 14, 2021

CVE Published

via MITRE·03:45 PM

Data Sourced

via MITRE·03:45 PM

DescriptionSeverityWeakness

Feb 27, 2025

Advisory Published

via ZDI·05:19 PM

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2021-27258.

What is the severity of CVE-2021-27258?

The severity of CVE-2021-27258 is critical with a CVSS score of 9.8.

What is the affected software for CVE-2021-27258?

The affected software for CVE-2021-27258 is SolarWinds Orion Platform 2020.2.

How can an attacker exploit CVE-2021-27258?

Remote attackers can exploit CVE-2021-27258 without requiring authentication.

Is there a fix available for CVE-2021-27258?

Please refer to the vendor's security advisory for information on available fixes for CVE-2021-27258.