VULNERABILITY INTELLIGENCE

CVE-2021-32076

CVSS score5.3 MEDIUM
EPSS probability1.17%
CISA KEVNot currently listed
Published2021-08-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback.

Weakness classification

  • psirt@solarwinds.com: CWE-290
  • nvd@nist.gov: CWE-290

Primary references