CVE-2021-35247

Katalog CVE

CVSS 5.3 · Medium KEV · sudah dieksploitasi EPSS 3,5%

Kerentanan Improper Input Validation pada solarwinds serv-u. Skor CVSS 3.1 5.3 (Medium) menurut NVD. Masuk katalog KEV CISA pada 21 Januari 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.

Rincian

Terbit di NVD

10 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

3,5% peluang dieksploitasi; lebih tinggi dari 88,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

SolarWinds Serv-U Improper Input Validation Vulnerability

Masuk KEV

21 Januari 2022

Tenggat CISA

4 Februari 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3_release_notes.ht... release notes · advisory vendor
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35247 broken link · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35247 pemerintah AS