{"id":"CVE-2021-32076","url":"https://www.cyber-defence.io/tools/cve/CVE-2021-32076","generatedAt":"2026-10-27T20:20:12.120Z","title":"Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2.","description":"Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback.","published":"2021-08-26T15:15:07.000Z","lastModified":"2026-06-17T03:52:46.000Z","status":"Modified","sourceIdentifier":"psirt@solarwinds.com","cvss":{"version":"3.1","score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cwe":["CWE-290"],"affected":["solarwinds/web help desk"],"epss":{"score":0.01172,"percentile":0.67225,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.17%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076","tags":["Vendor Advisory"],"source":"psirt@solarwinds.com"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/208278","tags":["Third Party Advisory","VDB Entry"],"source":"nvd@nist.gov"},{"url":"https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-32076","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}