CVE-2021-35242

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Serv-U server responds with valid CSRFToken when the request contains only Session.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Dec 6, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-352437.5The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server (12.7.7 and earlier), allowing users to execute dangerous HTTP CVE-2021-352447.2The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to anyCVE-2021-352456.8When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host maCVE-2021-352465.3The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a legitimate user's neCVE-2021-352475.3Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the inpuCVE-2021-352484.3It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic seCVE-2021-352494.3This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains wCVE-2021-352507.5A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to the Serv-U installatiCVE-2021-352515.3Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental deCVE-2021-352527.5Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is expoCVE-2021-352548.8SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this inputCVE-2021-352619.8File Upload Vulnerability in Yupoxion BearAdmin before commit 10176153528b0a914eb4d726e200fd506b73b075 allows attacker to execute arbitrary
CVE-2021-35242: High severity, CVSS 8.8 | Vulnix