CVE-2021-35214

The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the user session. This issue has been resolved on September 13, 2021.

CVSS v3 4.8 MEDIUM
CVSS v2.0 1.9 LOW

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.4 / Impact : 4.0

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

1.9^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35214	Broken Link
https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35214	Broken Link

Configurations

Configuration 1 (hide)

cpe:2.3:a:solarwinds:pingdom:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:12

Type	Values Removed	Values Added
References	~~() https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35214 - Broken Link~~	() https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35214 - Broken Link
CVSS	v2 : ~~1.9~~ v3 : ~~4.7~~	v2 : 1.9 v3 : 4.8

Information

Published : 2021-10-12 16:15

Updated : 2024-11-21 06:12

NVD link : CVE-2021-35214

Mitre link : CVE-2021-35214

CVE.ORG link : CVE-2021-35214

JSON object : View

Products Affected

solarwinds

pingdom

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2021-35214", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 1.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@solarwinds.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 0.4}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.0}]}, "published": "2021-10-12T16:15:07.370", "references": [{"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35214", "tags": ["Broken Link"], "source": "psirt@solarwinds.com"}, {"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35214", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the user session. This issue has been resolved on September 13, 2021."}, {"lang": "es", "value": "La vulnerabilidad en SolarWinds Pingdom puede describirse como un fallo en la invalidaci\u00f3n de la sesi\u00f3n de usuario al cambiar la contrase\u00f1a o la direcci\u00f3n de correo electr\u00f3nico. Cuando se ejecutaban varias sesiones activas en ventanas de navegador separadas, se observaba que se pod\u00eda cambiar la contrase\u00f1a o la direcci\u00f3n de correo electr\u00f3nico sin terminar la sesi\u00f3n de usuario. Este problema se ha resuelto el 13 de septiembre de 2021"}], "lastModified": "2024-11-21T06:12:04.480", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:solarwinds:pingdom:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A1507707-9EBD-4C54-A2AC-0FF4261DD3CF", "versionEndExcluding": "13.09.2021"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@solarwinds.com"}