FKIE_CVE-2021-35214

Vulnerability from fkie_nvd - Published: 2021-10-12 16:15 - Updated: 2026-06-17 03:57
Severity
4.8 (Medium) - CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
4.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Summary
The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the user session. This issue has been resolved on September 13, 2021.
References
psirt@solarwinds.comhttps://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35214Broken Link
af854a3a-2127-422b-91ae-364da2661108https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35214Broken Link
Impacted products
Vendor Product Version
solarwinds pingdom *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Pingdom",
          "vendor": "SolarWinds",
          "versions": [
            {
              "lessThan": "13.09.2021",
              "status": "affected",
              "version": "prior to 13.09.2021",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "psirt@solarwinds.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:solarwinds:pingdom:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A1507707-9EBD-4C54-A2AC-0FF4261DD3CF",
              "versionEndExcluding": "13.09.2021",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the user session. This issue has been resolved on September 13, 2021."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad en SolarWinds Pingdom puede describirse como un fallo en la invalidaci\u00f3n de la sesi\u00f3n de usuario al cambiar la contrase\u00f1a o la direcci\u00f3n de correo electr\u00f3nico. Cuando se ejecutaban varias sesiones activas en ventanas de navegador separadas, se observaba que se pod\u00eda cambiar la contrase\u00f1a o la direcci\u00f3n de correo electr\u00f3nico sin terminar la sesi\u00f3n de usuario. Este problema se ha resuelto el 13 de septiembre de 2021"
    }
  ],
  "id": "CVE-2021-35214",
  "lastModified": "2026-06-17T03:57:18.857",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 1.9,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.4,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "NONE",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 0.4,
        "impactScore": 4.0,
        "source": "psirt@solarwinds.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-10-12T16:15:07.370",
  "references": [
    {
      "source": "psirt@solarwinds.com",
      "tags": [
        "Broken Link"
      ],
      "url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35214"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35214"
    }
  ],
  "sourceIdentifier": "psirt@solarwinds.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.