CVE-2024-28995

Published Jun 6, 2024

Last updated 3 months ago

Exploit known CVSS high 8.6

web application

Supply chain

Overview

Description: SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
Source: psirt@solarwinds.com
NVD status: Analyzed
Products: serv-u

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: SolarWinds Serv-U Path Traversal Vulnerability
Exploit added on: Jul 17, 2024
Exploit action due: Aug 7, 2024
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

psirt@solarwinds.com: CWE-22
nvd@nist.gov: CWE-22

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "F4075BBF-2BC5-494C-81ED-AC85AD8D30CF",
            "versionEndExcluding": "15.4.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:solarwinds:serv-u:15.4.2:-:*:*:*:*:*:*",
            "matchCriteriaId": "60A6B282-872E-4228-A884-5DC5B44046BB",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:solarwinds:serv-u:15.4.2:hotfix1:*:*:*:*:*:*",
            "matchCriteriaId": "EBDF03FF-C508-42BD-9B70-9F972A14087B",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

Related CVEs

References