PT-2019-12684 · Solarwinds · Serv-U

Published 2019-06-17 · Updated 2023-01-30 · CVE-2019-12181

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U versions prior to 15.1.7 for Linux.

Description A privilege escalation issue exists, allowing potential exploitation.

Recommendations For versions prior to 15.1.7, update to version 15.1.7 or later to resolve the issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-12181

Affected Products

Serv-U

References · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/servu_ftp_server_prepareinstallation_priv_esc.rb · Exploit
• 🔥 https://github.com/mavlevin/CVE-2019-12181 · Exploit
• 🔥 https://github.com/guywhataguy/CVE-2019-12181 · Exploit
• 🔥 https://exploit-db.com/exploits/47072 · Exploit
• 🔥 https://exploit-db.com/exploits/47173 · Exploit
• 🔥 https://exploit-db.com/exploits/47009 · Exploit
• 🔥 http://packetstormsecurity.com/files/153333/Serv-U-FTP-Server-15.1.6-Privilege-Escalation.html · Exploit
• 🔥 http://packetstormsecurity.com/files/153505/Serv-U-FTP-Server-prepareinstallation-Privilege-Escalation.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12181 · Security Note
• https://support.solarwinds.com/SuccessCenter/s/article/Serv-U-Potential-elevation-of-privileges-on-Linux-systems · Vendor Advisory
• https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-1-7_release_notes.htm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12181 · Vendor Advisory
• https://blog.vastart.dev/2019/06/cve-2019-12181-serv-u-exploit-writeup.html · Note