A valid CSRF token is present in response to an invalid request
CVE-2021-35242

8.3HIGH

Key Information:

Vendor
Solarwinds
Status
Serv-u Server
Vendor
CVE Published:
6 December 2021

Summary

Serv-U server responds with valid CSRFToken when the request contains only Session.

Affected Version(s)

Serv-U Server 15.2.4 Hotfix 1 and previous versions < 15.2.5

References

https://documentation.solarwinds.com/en/success_center/se...
x_refsource_MISC
https://www.solarwinds.com/trust-center/security-advisori...
x_refsource_MISC

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.