PT-2024-22252 · Solarwinds · Serv-U Ftp Server

Published 2024-05-03 · Updated 2024-05-06 · CVE-2024-28072

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Serv-U FTP server (affected versions not specified)

Description A highly privileged account can overwrite arbitrary files on the system with log output due to improper sanitization of log file path tags.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2024-28072

Affected Products

Serv-U Ftp Server

References · 7

• https://osv.dev/vulnerability/CVE-2024-28072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28072 · Security Note
• https://solarwinds.com/trust-center/security-advisories/CVE-2024-28072 · Vendor Advisory
• https://t.me/cvenotify/78994 · Telegram Post
• https://twitter.com/CCBalert/status/1787490381287829877 · Twitter Post
• https://twitter.com/CVEnew/status/1786408516938297620 · Twitter Post
• https://solarwindscore.my.site.com/SuccessCenter/s/article/Serv-U-15-4-2-Hotfix-1-Release-Notes?language=en_US · Note