CISA KEV · Known exploitedMedium

CVE-2021-35247

SolarWinds Serv-U

Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.

CVSS: 5.3
EPSS: 3.45%
CISA KEV: Listed
Published: 2022.01.10

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability3.45%

Technical severityCVSS 5.3

Vulnerability overview

Affected product and versions

Product: SolarWinds Serv-U
Affected versions: 15.2.5 and previous versions, < 15.3
Fixed versions: 15.3

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply updates per vendor instructions.

Due date: 2022.02.04

1
Identify
Confirm that SolarWinds Serv-U and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE: CWE-20
KEV added: 2022.01.21
Ransomware use: 미확인