CVE-2021-35247 SolarWinds Serv-U Improper Input Validation
Insufficient input validation in Serv-U's LDAP login allowed unsanitized characters, though no downstream impact was detected.
- Exploited in the wild
- Since 21 Jan 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-35247?
CVE-2021-35247 is a medium-severity vulnerability in Solarwinds Serv-U, published on 7 Jan 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.
Weakness: CWE-20
Which versions are affected by CVE-2021-35247?
It affects 1 product.
Products include Solarwinds Serv-U.
How do I fix CVE-2021-35247?
No fix has been published for CVE-2021-35247 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 4 Feb 2022.
Is CVE-2021-35247 being exploited?
Yes. Attackers have exploited CVE-2021-35247 in the wild since at least 21 Jan 2022.
Other vulnerabilities in Solarwinds Serv-U
- CVE-2021-35211 SolarWinds Serv-U Remote Code Execution
- CVE-2024-28995 SolarWinds Serv-U Path Traversal Vulnerability
- CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource Consumption
- CVE-2020-35481 Code injection in n/a
- CVE-2026-28302 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
Sources
Also known as GHSA-jqwj-9jvg-583v.