Medium severity · published Apr 15, 2025
CVE-2024-45712
SolarWinds Serv-U is vulnerable to a client-side cross-site scripting (XSS) vulnerability
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
SolarWinds Serv-U is vulnerable to a client-side cross-site scripting (XSS) vulnerability. The vulnerability can only be performed by an authenticated account, on the local machine, from the local browser session. Therefore the risk is very low.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Serv-U · SolarWinds
before 15.5.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45712
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45712
Release Notes
https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-1_release_notes.htm
Patch
https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45712
More from Serv-U
10.0
CVE-2021-35211
Serv-U Remote Memory Escape Vulnerability
7.5
CVE-2026-28318
SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability
7.5
CVE-2024-28995
SolarWinds Serv-U L Directory Transversal Vulnerability
5.3
CVE-2021-35247
Improper Input Validation Vulnerability in Serv-U
9.8
CVE-2020-35481
SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection