Medium severity · published Jan 7, 2022
CVE-2021-35247
Improper Input Validation Vulnerability in Serv-U
In wildKEV
5.3
CVSS
3.5%
EPSS
Yes
On KEV
Description
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildYes
CISA KEVListed Jan 21, 2022
Federal remediation dueFeb 4, 2022
Ransomware campaign useNot known
Affected products
Which versions
SE
Serv-U · SolarWinds
15.2.5 and previous versions before 15.3 · source: vendor, NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-35247
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-35247
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35247
x_refsource_MISC
https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3_release_notes.htm
More from Serv-U
10.0
CVE-2021-35211
Serv-U Remote Memory Escape Vulnerability
7.5
CVE-2026-28318
SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability
7.5
CVE-2024-28995
SolarWinds Serv-U L Directory Transversal Vulnerability
9.8
CVE-2020-35481
SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection
9.1
CVE-2026-28321
SolarWinds Serv-U Broken Access Control Vulnerability