CVE-2021-35249

This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should not have access to. Please note the admin is unable to modify the data (read only operation). This UAC issue leads to a data leak to unauthorized users for a domain, with no log of them accessing the data unless they attempt to modify it. This read-only activity is logged to the original domain and does not specify which domain was accessed.

• CWE-284

• https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3-1_release_notes.htmRelease Notes, Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35249Vendor Advisory
• https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3-1_release_notes.htmRelease Notes, Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35249Vendor Advisory

Published

May 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35243The HTTP PUT and DELETE methods were enabled in the Web Help…7.5
• CVE-2021-35244The "Log alert to a file" action within action management en…7.2
• CVE-2021-35245When a user has admin rights in Serv-U Console, the user can…6.8
• CVE-2021-35246The application fails to prevent users from connecting to it…5.3
• CVE-2021-35247Serv-U web login screen to LDAP authentication was allowing …5.3
• CVE-2021-35248It has been reported that any Orion user, e.g. guest account…4.3
• CVE-2021-3525Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-35250A researcher reported a Directory Transversal Vulnerability …7.5
• CVE-2021-35251Sensitive information could be displayed when a detailed tec…5.3
• CVE-2021-35252Common encryption key appears to be used across all deployed…7.5
• CVE-2021-35254SolarWinds received a report of a vulnerability related to a…8.8
• CVE-2021-3526Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…