How severe is CVE-2021-35247?

CVE-2021-35247 has a CVSS 3.1 base score of 4.3 (MEDIUM). EPSS estimates a 3.5% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2021-35247: Improper Input Validation Vulnerability in

CISA Known Exploited Vulnerabilities

SolarWinds Serv-U Improper Input Validation Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2022-01-21

Remediation due

2022-02-04

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2021-35247

Description

Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.

Severity

CVSS 3.1 · CNA4.3 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SSVC · CISA-ADP

Exploitationactive

Automatableno

Technical impactpartial

Affected Products

Vendor	Product	Affected versions
SolarWinds	Serv-U	15.2.5 and previous versions to <15.3

References

2 Links

Other references

Record Details

Published

2022-01-07

Last updated

2025-10-21

Assigner (CNA)

SolarWinds

Credited to

SolarWinds would like to thank Jonathan Bar Or of Microsoft (@yo_yo_yo_jbo) for reporting this vulnerability

More from SolarWinds

CVE-2024-289958.6

SolarWinds Serv-U L Directory Transversal Vulnerability

CVE-2024-289879.1

SolarWinds Web Help Desk Hardcoded Credential Vulnerability

CVE-2020-101489.8

SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands

CVE-2021-352119

Serv-U Remote Memory Escape Vulnerability

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CWE-20 · Improper Input Validation

Application Security Tools Fuzzing

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.