title: Unrestricted access to Orion.UserSettings SWIS entity for low-privilege users
description: It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings.
problem types: CWE-732 Improper Access Control
affected:
{
defaultStatus: unaffected
platforms: Windows
product: Orion
vendor: SolarWinds
versions:
lessThan:  2020.2.6 HF 3 , status: affected, version: 2020.2.6 HF 2 and previous versions , versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: This vulnerability has been fixed in Orion version 2020.2.6 HF3, customers are advised to upgrade to the latest version once it it is available.
workarounds: If you are unable to upgrade immediately. See SolarWinds Knowledgebase Article Below:
https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-Unrestricted-access-to-Orion-UserSettings-SWIS-entity-for-low-privilege-users-CVE-2021-35248