#VU57855 Information disclosure in Pingdom - CVE-2021-35214
Published: November 2, 2021
Vulnerability identifier: #VU57855
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2021-35214
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Pingdom
Pingdom
Software vendor:
SolarWinds
SolarWinds
Description
The vulnerability allows a local attacker to gain access to potentially sensitive information.
The vulnerability exists due to the affected application fails to invalidate user session upon password or email address change. An attacker with physical access can change a password or email address without terminating the user session during multiple active browser sessions.
Remediation
Install updates from vendor's website released on 13th September, 2021.