CVE-2021-32076CWE-290

Access Restriction bypass vulnerability via referrer spoof - Business Logic Bypass

Medium · published August 26, 2021

CVSS v3.1
5.3
EPSS
1%
Percentile
67.2
In the wild
Unconfirmed
What it is

Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01172 · 67.2th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2021-08-26T14:53Z
EPSS history
Timeline
  • 26 AUG 14:53Z
    Access Restriction bypass vulnerability via referrer spoof - Business Logic Bypass
    cvelistv5