10

CVE-2021-35211

Warnung
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Solarwinds ≫ Serv-u Version < 15.2.3
Solarwinds ≫ Serv-u Version15.2.3 Update-
Solarwinds ≫ Serv-u Version15.2.3 Updatehotfix1

03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog

SolarWinds Serv-U Remote Code Execution Vulnerability

Schwachstelle

SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 94.32% 0.999
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 10 3.9 6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
psirt@solarwinds.com 9 2.2 6
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.