CISA • 4w
CISA Adds SolarWinds Serv-U Vulnerability CVE-2024-28995 to KEV Catalog
CVE-2024-28995 is a high-severity path traversal vulnerability in SolarWinds Serv-U (versions 15.4.2 HF 1 and prior) that allows unauthenticated remote attackers to read arbitrary files from the host system. The flaw exists in the BuildLocalPath method due to improper validation of the InternalDir and InternalFile parameters, enabling attackers to bypass directory restrictions via crafted GET requests. Given confirmed active exploitation by both automated scanners and manual threat actors, CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on July 17, 2024. Immediate remediation via upgrade to version 15.4.2 HF 2 is required to prevent sensitive system data exfiltration.
Links:Cisa, Wiu, Cybersecuritynews, CISA Cybersecurity Advisories, feeds.feedburner.com, Securityaffairs, Github, Scworld, Bleepingcomputer, Rapid7, Kkm-mako, Securityonline, Nvd, Sentinelone, The Hacker News, Threat-modeling, Sansec, Tenable, Fortiguard, Ionix, Labs, Sonicwall, Cve, Ncsc, Sara-open, Digital, Greynoise, Reddit, Mondoo, Windowsforum, Security Affairs, Youtube, Mallory, App, threat-modeling.com, helpnetsecurity.com, cyberscoop.com, SC Media, Cyberwarrior76, cybersecuritydive.com, runzero.com, The Record by Recorded Future, Afcea, Doncio, Blog, Wiley, Vistrada, Adaptiva, Industrial Cyber, bleepingcomputer.com, Infosecurity-magazine, Securityweek, Nucleussec, Executivegov, Community, Automox, Cybersecuritydive, Resilientcyber, techjacksolutions.com, Securityboulevard, Techtarget, Psilvas, Hipaajournal, Dark Reading •