Client-Side Cross-Site Scripting Vulnerability in SolarWinds Serv-U
CVE-2024-45712

2.6LOW

Key Information:

Vendor
Solarwinds
Status
Serv-u
Vendor
CVE Published:
15 April 2025

Summary

SolarWinds Serv-U contains a vulnerability that exposes the application to client-side cross-site scripting (XSS) attacks. This issue arises when an authenticated user accesses the application from a local browser session. Although the attack requires user authentication, which limits the potential scope, it is essential for users to be aware of this vulnerability and implement necessary mitigations. Always ensure to maintain product updates and follow security best practices to mitigate any potential impact.

Affected Version(s)

Serv-U Serv-U 15.5 and previous versions

References

https://www.solarwinds.com/trust-center/security-advisori...
https://documentation.solarwinds.com/en/success_center/se...

CVSS V3.1

Score:
2.6
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.