Local Access Vulnerability in SolarWinds Serv-U FTP Server
CVE-2018-19999

7.8HIGH

Key Information:

Vendor

Solarwinds
Status
Serv-u Ftp Server
Vendor
CVE Published:
7 June 2019

What is CVE-2018-19999?

The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 contains improper access controls that allow local users to bypass authentication. This oversight permits an attacker with local access to execute arbitrary code under the Windows SYSTEM account, potentially leading to escalation of privileges. To successfully exploit this vulnerability, an attacker must gain local access to the system where Serv-U is installed as well as ensure that a Serv-U administrator has an active management console session.

References

https://www.themissinglink.com.au/security-advisories-cve...
x_refsource_MISC
https://seclists.org/fulldisclosure/2019/May/46
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.