PT-2021-19413 · Solarwinds · Serv-U

Published 2021-05-04 · Updated 2022-07-12 · CVE-2021-3154

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U versions prior to 15.2.2

Description An issue was discovered that allows unauthenticated attackers to retrieve cleartext passwords via macro injection.

Recommendations For versions prior to 15.2.2, update to version 15.2.2 or later to resolve the issue.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2021-3154

Affected Products

Serv-U

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-3154 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3154 · Vendor Advisory
• https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-2-2_release_notes.htm · Vendor Advisory