Vulnerability Intelligence Report
Improper Input Validation Vulnerability in Serv-U
CVE-2021-35247
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.
CISA KEV
SSVC: Active Exploitation
CVSS Base Score
4.3
MEDIUM
Exploitability:2.9
Impact Score:1.5
EPSS Probability:3.36%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-20 ↗CWE-20 Improper Input Validation
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| SolarWinds | Serv-U | 15.2.5 and previous versions < 15.3 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | SolarWinds · Vendor · USA |
| Reserved | 2021-06-22T00:00:00 |
| Published | 2022-01-07T22:39:50 |
| Patch Date | 2022-01-05 |
| Last Updated | 2025-10-21T23:15:49 |
Community Chatter & Buzz