CVE-2021-35247
SolarWinds Serv-U: Improper Input Validation
As of , CVE-2021-35247 in SolarWinds Serv-U is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch soon.
- Exploited
- Yes: CISA listed it on 21 January 2022
- US federal deadline
- 4 February 202214 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Not known to CISA
- EPSS score
- 0.03Higher than 88% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- EPSS when listed
- Not availableCISA listed it before 4 February 2022, where the EPSS files we read begin.
- Public exploit
- None foundNeither Metasploit nor Exploit-DB lists one.
- Fix
- No vendor link in CISA's entry
What CISA says to do
Apply updates per vendor instructions.
CISA's required action
What the flaw is
SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization.
CISA's description
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.
The CVE record's description, from SolarWinds
- CVE published
- 7 January 2022
- Assigned by
- SolarWinds
- CVSS
- 4.3 Medium (CVSS 3.1, from the CNA)
- CWE-20
- Improper Input Validation
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- no
- CISA SSVC, technical impact
- partial
Timeline
- The CVE record was published.
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
Serv-U: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2024-28995Path Traversal | SolarWinds Serv-U | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| CVE-2021-35211Remote Code Execution | SolarWinds Serv-U | Patch this weekRansomware use; EPSS 0.91 | 0.91 | ||
| CVE-2026-28318Uncontrolled Resource Consumption | SolarWinds Serv-U | Patch soon | 0.02 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org