Session Management Vulnerability
Priority LOW 26CWE-613Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-613.
Summary
The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the user session. This issue has been resolved on September 13, 2021.
Why it matters now
EPSS 0.01827 78th percentileScored 2026-11-07
Fix Fixed Pingdom (SolarWinds): 13.09.2021
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SolarWinds | Pingdom | prior to 13.09.2021 to before 13.09.2021 | 13.09.2021 | Patch available | CNA |
- Pingdom VendorSolarWinds Affected prior to 13.09.2021 to before 13.09.2021 Fixed in 13.09.2021 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:solarwinds:pingdom:*:*:*:*:*:*:*:* | before 13.09.2021 | Vulnerable | SolarWinds |
- cpe:2.3:a:solarwinds:pingdom:*:*:*:*:*:*:*:* Versions before 13.09.2021 Vulnerable ·SolarWinds
Remediation
- Fix · CNA Pingdom (SolarWinds) Fixed in 13.09.2021
Timeline
- 2026-10-02 Threatist record created from CVE-2021-35214
- 2026-10-03 Alias added: GHSA-r8pm-g6v2-5wgx
Sources
- CVE-2021-35214 · CVE Program
- CVE-2021-35214 · NVD
- FIRST EPSS
- GHSA-r8pm-g6v2-5wgx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences