5.4
CVSS
SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS.
Severity: MEDIUM
📦
serv-u
Vendor: solarwinds
Actively Exploited
4
CISA KEV List
PoC / Exploits
4
Code Available
Total RCEs
2
Remote Access
Total CVEs
54
Total Indexed
Avg. EPSS
8.57%
Exploit Prob.
Security Vulnerability Index
Page 4 / 6
9.8
CVSS
SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection.
Severity: CRITICAL
5.4
CVSS
SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS.
Severity: MEDIUM
6.5
CVSS
SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal.
Severity: MEDIUM
7.5
CVSS
SolarWinds Serv-U File Server before 15.2.1 allows information disclosure via an HTTP response.
Severity: HIGH
6.1
CVSS
SolarWinds Serv-U File Server before 15.2.1 allows XSS as demonstrated by Tenable Scan, aka Case Number 00484194.
Severity: MEDIUM
7.5
CVSS
SolarWinds Serv-U File Server before 15.2.1 mishandles the Same-Site cookie attribute, aka Case Number 00331893.
Severity: HIGH
6.1
CVSS
SolarWinds Serv-U File Server before 15.2.1 has a "Cross-script vulnerability," aka Case Numbers 00041778 and 00306421.
Severity: MEDIUM
6.5
CVSS
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the application (with a NULL pointer dereference) via a specially crafted URL beginning with the /Web%20Client/ substring.
Severity: MEDIUM
7.3
CVSS
SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the application as a URL parameter in lieu of a session cookie. This session token's value can be brute-forced by an attacker to obtain the corresponding session cookie and hijack the user's session.
Severity: HIGH