CVE-2021-32076

Published: Aug 26, 2021Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback.

Affected (1)

Products: Solarwinds: Web Help Desk

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Solarwinds Web Help Desk	Up to 12.7.2

Related CWEs

Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

References (3)

https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076

Source: psirt@solarwinds.com

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/208278

Source: nvd@nist.gov

Third Party AdvisoryVDB Entry

https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.