PT-2021-11441 · Solarwinds · Serv-U

Jack Misiura · Published 2021-02-03 · Updated 2021-02-25 · CVE-2020-28001

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: SolarWinds Serv-U versions prior to 15.2.2

Description: The issue allows for Authenticated Stored XSS. This means that an authenticated attacker can inject malicious code into the application, which will then be stored and executed by the application, potentially affecting other users.

Recommendations: For versions prior to 15.2.2, update to version 15.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-28001

Affected Products

Serv-U

References · 7

• 🔥 http://packetstormsecurity.com/files/161400/SolarWinds-Serv-U-FTP-Server-15.2.1-Cross-Site-Scripting.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2021/Feb/37 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-28001 · Security Note
• https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-2_release_notes.htm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-28001 · Vendor Advisory
• https://themissinglink.com.au/security-advisories-cve-2020-28001 · Note
• https://t.me/cvenotify/9892 · Telegram Post