CVE-2021-35223

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables, allowing remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Aug 31, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-352256.4Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all thaCVE-2021-352266.5An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service (SWIS). ExCVE-2021-352277.8The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTPS was not available.CVE-2021-352284.7This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific sectioCVE-2021-352296.1Cross-site scripting vulnerability is present in Database Performance Monitor 2022.1.7779 and previous versions when using a complex SQL queCVE-2021-35237.5A flaw was found in 3Scale APICast in versions prior to 2.11.0, where it incorrectly identified connections for reuse. This flaw allows an aCVE-2021-352306.7As a result of an unquoted service path vulnerability present in the Kiwi CatTools Installation Wizard, a local attacker could gain escalateCVE-2021-352316.7As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain escCVE-2021-352326.1Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web CVE-2021-352335.3The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes onlyCVE-2021-352348.8Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation. An attacker CVE-2021-352355.3The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions. ASP.NET allows remote debugging of web ap