title: Netpath Horizontal Privilege Escalation Vulnerability: NPM 2020.2.5
description: Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data cross-contamination.
problem types: Netpath Horizontal Privilege Escalation Vulnerability: NPM 2020.2.5
affected:
{
platforms: Windows
product: NPM
vendor: SolarWinds
versions:
lessThan: 2020.2.6 Hotfix 2 , status: affected, version: 2020.2.6 Hotfix 1 and previous versions , versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
version: 3.1
]
solutions: SolarWinds recommends upgrading to the latest version of Network Performance Monitor 2020.2.6 Hotfix 2 as soon as it becomes available.  All customers should review and implement all of the recommendations from the Orion Secure Configuration Guide
workarounds: In the mentioned workaround, Customers can restrict the viewing of access rights for non-admin users via Orion UI. \nhttps://support.solarwinds.com/SuccessCenter/s/article/Orion-NPM-NetPath-account-limitations?language=en_US