Actively exploited · Published Jan 7, 2022 · Assigned by SolarWinds
CVE-2021-35247Improper Input Validation Vulnerability in Serv-U
Medium 4.3 Exploited
In plain English
A medium-severity improper input validation in Serv-U from SolarWinds. Attackers are actively exploiting it in the wild (listed by CISA on January 21, 2022). The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 90% of all known vulnerabilities). Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Feb 4, 2022.
Official description
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SolarWinds | Serv-U | 15.2.5 and previous versions – before 15.3 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35247 x_refsource_MISC
- https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3_release_notes.htm x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35247 government-resource