Local Access Vulnerability in SolarWinds Serv-U FTP Server
CVE-2018-19999

7.8HIGH

Key Information:

Vendor
Solarwinds
Vendor
CVE Published:
7 June 2019

Summary

The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 contains improper access controls that allow local users to bypass authentication. This oversight permits an attacker with local access to execute arbitrary code under the Windows SYSTEM account, potentially leading to escalation of privileges. To successfully exploit this vulnerability, an attacker must gain local access to the system where Serv-U is installed as well as ensure that a Serv-U administrator has an active management console session.

References

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.