CVE-2024-28995

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jun 6, 2024
Last modified
Jun 17, 2026
Added to CISA KEV
Jul 17, 2024
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-289967.5The SolarWinds Platform was determined to be affected by a SWQL Injection Vulnerability. Attack complexity is high for this vulnerability.CVE-2024-289997.5The SolarWinds Platform was determined to be affected by a Race Condition Vulnerability affecting the web console.CVE-2024-29008.8A vulnerability, which was classified as critical, was found in Tenda AC7 15.03.06.44. This affects the function saveParentControlInfo of thCVE-2024-290004.3The SolarWinds Platform was determined to be affected by a reflected cross-site scripting vulnerability affecting the web console. A high-prCVE-2024-290017.4A SolarWinds Platform SWQL Injection Vulnerability was identified in the user interface. This vulnerability requires authentication and userCVE-2024-290034.8The SolarWinds Platform was susceptible to a XSS vulnerability that affects the maps section of the user interface. This vulnerability requiCVE-2024-290044.3The SolarWinds Platform was determined to be affected by a stored cross-site scripting vulnerability affecting the web console. A high-priviCVE-2024-290069.8By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an API request. This couCVE-2024-290077.3The CloudStack management server and secondary storage VM could be tricked into making requests to restricted or random resources by means oCVE-2024-290086.4A problem has been identified in the CloudStack additional VM configuration (extraconfig) feature which can be misused by anyone who has priCVE-2024-290096.1Cross-site request forgery (CSRF) vulnerability in easy-popup-show all versions allows a remote unauthenticated attacker to hijack the autheCVE-2024-29018.8A vulnerability has been found in Tenda AC7 15.03.06.44 and classified as critical. This vulnerability affects the function setSchedWifi of
CVE-2024-28995: High severity, CVSS 7.5 | Vulnix