CVE-2021-35249 Domain Admin Broken Access Control

What is CVE-2021-35249?

CVE-2021-35249 is a medium-severity missing authorization vulnerability in Solarwinds Serv-U, published on 17 May 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should not have access to. Please note the admin is unable to modify the data (read only operation). This UAC issue leads to a data leak to unauthorized users for a domain, with no log of them accessing the data unless they attempt to modify it. This read-only activity is logged to the original domain and does not specify which domain was accessed.

Weakness: CWE-284

Which versions are affected by CVE-2021-35249?

It affects 1 product.

Products include Solarwinds Serv-U.

How do I fix CVE-2021-35249?

No fix has been published for CVE-2021-35249 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-35249 being exploited?

There is no known exploitation of CVE-2021-35249 in the wild and no public exploit code.

Other vulnerabilities in Solarwinds Serv-U

• CVE-2021-35211 SolarWinds Serv-U Remote Code Execution Exploited Critical 9.0
• CVE-2024-28995 SolarWinds Serv-U Path Traversal Vulnerability Exploited High 8.6
• CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource Consumption Exploited High 7.5
• CVE-2021-35247 SolarWinds Serv-U Improper Input Validation Exploited Medium 4.3
• CVE-2020-35481 Code injection in n/a Critical 9.8

All Solarwinds Serv-U vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wx33-6v5h-q453.