CVE-2024-45711: falha de alta gravidade em SolarWinds Serv-U
SolarWinds Serv-U FTP Service Directory Traversal Remote Code Execution Vulnerability
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 6.3%
SolarWinds Serv-U is vulnerable to a directory traversal vulnerability where remote code execution is possible depending on privileges given to the authenticated user. This issue requires a user to be authenticated and this is present when software environment variables are abused. Authentication is required for this vulnerability
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
SolarWinds · Serv-UCVEs relacionadas — SolarWinds Serv-U
No mesmo produto, das mais perigosas para as menos.
CVE-2026-28318HIGHSolarWinds Serv-U Unauthenticated Denial of Service VulnerabilityEPSS 43.7%KEVCVE-2021-35247MEDIUMImproper Input Validation Vulnerability in Serv-UEPSS 3.7%KEVCVE-2021-35250HIGHDirectory Transversal Vulnerability in Serv-U 15.3EPSS 12.8%CVE-2021-35223HIGHExecute Command Function Allows Remote Code Execution (RCE)VulnerabilityEPSS 2.9%CVE-2026-28316CRITICALSolarWinds Serv-U Insecure Direct Object Reference (IDOR) VulnerabilityEPSS 2.1%CVE-2025-40549CRITICALSolarWinds Serv-U Path Restriction Bypass VulnerabilityEPSS 1.1%