title: Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6
description: Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.
problem types: Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6
affected:
{
defaultStatus: unaffected
platforms: Windows
product: SolarWinds Platform
vendor: SolarWinds
versions:
lessThan: 2022.3, status: affected, version: 2022.3 and previous, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL