CVE-2021-35247

MediumCVSS 5.3/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
SolarWinds	Serv-U	>= 15.2.5 and previous versions, < 15.3

References

https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3_release_notes.htmRelease Notes, Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35247Broken Link, Vendor Advisory
https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3_release_notes.htmRelease Notes, Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35247Broken Link, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35247US Government Resource

Timeline

Published: Jan 10, 2022
Last modified: Jun 17, 2026
Added to CISA KEV: Jan 21, 2022
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-352484.3It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic se CVE-2021-352494.3This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains w CVE-2021-352507.5A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to the Serv-U installati CVE-2021-352515.3Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental de CVE-2021-352527.5Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is expo CVE-2021-352548.8SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input CVE-2021-352619.8File Upload Vulnerability in Yupoxion BearAdmin before commit 10176153528b0a914eb4d726e200fd506b73b075 allows attacker to execute arbitrary CVE-2021-352656.1A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitra CVE-2021-352667.8In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur CVE-2021-352677.8NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and MFTMirror allowing for code execu CVE-2021-352687.8In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a heap buffer overflow CVE-2021-352697.8NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_setup_flag, a heap buf