CVE-2021-32076

5.3 mediumEPSS 1.2%

Medium (5.3) in solarwinds web help desk. EPSS 1.2% chance of exploitation in the next 30 days.

Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
CWE: CWE-290
Published: 2021-08-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

solarwinds:web_help_desk

References

https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076
https://exchange.xforce.ibmcloud.com/vulnerabilities/208278
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076

Check your stack JSON