← Zuruck zu CVEs

CVE-2021-35247

MEDIUMCISA KEV

4.3

Beschreibung

Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.

CVE Details

CVSS v3.1 Bewertung4.3

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionREQUIRED

Veroffentlicht1/10/2022

Zuletzt geandert10/27/2025

Quellekev

Honeypot-Sichtungen0

CISA KEV

HerstellerSolarWinds

ProduktServ-U

SchwachstellennameSolarWinds Serv-U Improper Input Validation Vulnerability

KEV Aufnahmedatum2022-01-21

Behebungsfrist2022-02-04

Ransomware-NutzungUnknown

Betroffene Produkte

solarwinds:serv-u

Schwachen (CWE)

CWE-20

Referenzen

https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3_release_notes.htm(psirt@solarwinds.com)

https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35247(psirt@solarwinds.com)

https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3_release_notes.htm(af854a3a-2127-422b-91ae-364da2661108)

https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35247(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35247(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.