CVE-2021-35252

Description

Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is exposed to an attacker can be simply recovered to plaintext.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected products

SolarWinds / Serv-U FTP Server15.3.0 – 15.3.0

References

MISChttps://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3-2_release_notes.htm
CONFIRMhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35252
VENDOR_ADVISORYhttps://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35252