Rapid7’s 2026 Global Cybersecurity Summit is now available on-demand.Watch sessions.
Rapid7

vulnerability

SolarWinds Orion Platform: Unrestricted access to Orion UserSettings SWIS entity for low-privilege users (CVE-2021-35248)

Severity
4
CVSS
(AV:N/AC:L/Au:S/C:P/I:N/A:N)
Published
Dec 20, 2021
Added
Feb 24, 2022
Modified
Feb 24, 2022

Description

It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings.

Solution

solarwinds-orion-platform-upgrade-2020_2_6
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.