cvelistv5 - cve-2021-35211

CVE-2021-35211 (GCVE-0-2021-35211)

Vulnerability from cvelistv5

Published

2021-07-14 20:55

Modified

2025-10-21 23:25

Severity ?

9.0 (Critical) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE

Memory Escape Vulnerability in Solarwinds Serv-U

Summary

Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.

References

URL

Tags

psirt@solarwinds.com	https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit	Patch, Vendor Advisory
psirt@solarwinds.com	https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211	Patch, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35211

Impacted products

	Vendor	Product	Version
	SolarWinds	Serv-U Managed File Transfer Server and Serv-U Secured FTP	Version: SolarWinds Serv-U < 15.2.3 HF1

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

Date added: 2021-11-03

Due date: 2021-11-17

Required action: Apply updates per vendor instructions.

Used in ransomware: Known

Notes: https://nvd.nist.gov/vuln/detail/CVE-2021-35211

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:33:51.183Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-35211",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T19:06:30.616456Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35211"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:25:40.369Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35211"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00+00:00",
            "value": "CVE-2021-35211 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Windows"
          ],
          "product": "Serv-U Managed File Transfer Server and Serv-U Secured FTP",
          "vendor": "SolarWinds",
          "versions": [
            {
              "lessThan": "15.2.3 HF1",
              "status": "affected",
              "version": "SolarWinds Serv-U",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "SolarWinds would like to thank the Microsoft Threat Intelligence Center (MSTIC) and Microsoft Offensive Security Research teams for reporting on the issue in a responsible manner."
        }
      ],
      "datePublic": "2021-07-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Memory Escape Vulnerability in Solarwinds Serv-U",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-07-14T20:55:25.000Z",
        "orgId": "49f11609-934d-4621-84e6-e02e032104d6",
        "shortName": "SolarWinds"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "SolarWinds has released a hotfix 15.2.3 HF2 It is suggested to upgrade to the latest hotfix as soon as possible"
        }
      ],
      "source": {
        "defect": [
          "CVE-2021-35211"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Serv-U Remote Memory Escape Vulnerability",
      "workarounds": [
        {
          "lang": "en",
          "value": "SolarWinds advises to disconnect Serv-U Server from internet until patched."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@solarwinds.com",
          "DATE_PUBLIC": "2021-07-13T16:16:00.000Z",
          "ID": "CVE-2021-35211",
          "STATE": "PUBLIC",
          "TITLE": "Serv-U Remote Memory Escape Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Serv-U Managed File Transfer Server and Serv-U Secured FTP",
                      "version": {
                        "version_data": [
                          {
                            "platform": "Windows",
                            "version_affected": "\u003c",
                            "version_name": "SolarWinds Serv-U",
                            "version_value": "15.2.3 HF1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SolarWinds"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "SolarWinds would like to thank the Microsoft Threat Intelligence Center (MSTIC) and Microsoft Offensive Security Research teams for reporting on the issue in a responsible manner."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Memory Escape Vulnerability in Solarwinds Serv-U"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211",
              "refsource": "MISC",
              "url": "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211"
            },
            {
              "name": "https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit",
              "refsource": "MISC",
              "url": "https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "SolarWinds has released a hotfix 15.2.3 HF2 It is suggested to upgrade to the latest hotfix as soon as possible"
          }
        ],
        "source": {
          "defect": [
            "CVE-2021-35211"
          ],
          "discovery": "EXTERNAL"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "SolarWinds advises to disconnect Serv-U Server from internet until patched."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "49f11609-934d-4621-84e6-e02e032104d6",
    "assignerShortName": "SolarWinds",
    "cveId": "CVE-2021-35211",
    "datePublished": "2021-07-14T20:55:25.167Z",
    "dateReserved": "2021-06-22T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:25:40.369Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2021-35211",
      "cwes": "[\"CWE-787\"]",
      "dateAdded": "2021-11-03",
      "dueDate": "2021-11-17",
      "knownRansomwareCampaignUse": "Known",
      "notes": "https://nvd.nist.gov/vuln/detail/CVE-2021-35211",
      "product": "Serv-U",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution.",
      "vendorProject": "SolarWinds",
      "vulnerabilityName": "SolarWinds Serv-U Remote Code Execution Vulnerability"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-35211\",\"sourceIdentifier\":\"psirt@solarwinds.com\",\"published\":\"2021-07-14T21:15:08.090\",\"lastModified\":\"2025-10-22T00:17:38.573\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.\"},{\"lang\":\"es\",\"value\":\"Microsoft descubri\u00f3 una vulnerabilidad de ejecuci\u00f3n de c\u00f3digo remota (RCE) en el producto SolarWinds Serv-U usando una Vulnerabilidad de Escape de Memoria Remota. Si es explotado, un actor de la amenaza puede ser capaz de obtener acceso privilegiado a la m\u00e1quina que aloja Serv-U solamente. SolarWinds Serv-U Managed File Transfer y Serv-U Secure FTP para Windows versiones anteriores a 15.2.3 HF2 est\u00e1n afectados por esta vulnerabilidad\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@solarwinds.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:C/I:C/A:C\",\"baseScore\":10.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"cisaExploitAdd\":\"2021-11-03\",\"cisaActionDue\":\"2021-11-17\",\"cisaRequiredAction\":\"Apply updates per vendor instructions.\",\"cisaVulnerabilityName\":\"SolarWinds Serv-U Remote Code Execution Vulnerability\",\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"15.2.3\",\"matchCriteriaId\":\"66A68531-7831-4875-B0AB-215C3E5A62B6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:solarwinds:serv-u:15.2.3:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E8B32A1-90C1-4901-9B66-FA72E5787450\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:solarwinds:serv-u:15.2.3:hotfix1:*:*:*:*:*:*\",\"matchCriteriaId\":\"92569E9A-911C-4704-A962-047FF5E0E2CF\"}]}]}],\"references\":[{\"url\":\"https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit\",\"source\":\"psirt@solarwinds.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211\",\"source\":\"psirt@solarwinds.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35211\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"platforms\": [\"Windows\"], \"product\": \"Serv-U Managed File Transfer Server and Serv-U Secured FTP\", \"vendor\": \"SolarWinds\", \"versions\": [{\"lessThan\": \"15.2.3 HF1\", \"status\": \"affected\", \"version\": \"SolarWinds Serv-U\", \"versionType\": \"custom\"}]}], \"credits\": [{\"lang\": \"en\", \"value\": \"SolarWinds would like to thank the Microsoft Threat Intelligence Center (MSTIC) and Microsoft Offensive Security Research teams for reporting on the issue in a responsible manner.\"}], \"datePublic\": \"2021-07-13T00:00:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 9, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"CHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"version\": \"3.1\"}}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"Memory Escape Vulnerability in Solarwinds Serv-U\", \"lang\": \"en\", \"type\": \"text\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2021-07-14T20:55:25.000Z\", \"orgId\": \"49f11609-934d-4621-84e6-e02e032104d6\", \"shortName\": \"SolarWinds\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"SolarWinds has released a hotfix 15.2.3 HF2 It is suggested to upgrade to the latest hotfix as soon as possible\"}], \"source\": {\"defect\": [\"CVE-2021-35211\"], \"discovery\": \"EXTERNAL\"}, \"title\": \"Serv-U Remote Memory Escape Vulnerability\", \"workarounds\": [{\"lang\": \"en\", \"value\": \"SolarWinds advises to disconnect Serv-U Server from internet until patched.\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.0.9\"}, \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"psirt@solarwinds.com\", \"DATE_PUBLIC\": \"2021-07-13T16:16:00.000Z\", \"ID\": \"CVE-2021-35211\", \"STATE\": \"PUBLIC\", \"TITLE\": \"Serv-U Remote Memory Escape Vulnerability\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"Serv-U Managed File Transfer Server and Serv-U Secured FTP\", \"version\": {\"version_data\": [{\"platform\": \"Windows\", \"version_affected\": \"\u003c\", \"version_name\": \"SolarWinds Serv-U\", \"version_value\": \"15.2.3 HF1\"}]}}]}, \"vendor_name\": \"SolarWinds\"}]}}, \"credit\": [{\"lang\": \"eng\", \"value\": \"SolarWinds would like to thank the Microsoft Threat Intelligence Center (MSTIC) and Microsoft Offensive Security Research teams for reporting on the issue in a responsible manner.\"}], \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.\"}]}, \"generator\": {\"engine\": \"Vulnogram 0.0.9\"}, \"impact\": {\"cvss\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 9, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"CHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"version\": \"3.1\"}}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"Memory Escape Vulnerability in Solarwinds Serv-U\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211\", \"refsource\": \"MISC\", \"url\": \"https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211\"}, {\"name\": \"https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit\", \"refsource\": \"MISC\", \"url\": \"https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit\"}]}, \"solution\": [{\"lang\": \"en\", \"value\": \"SolarWinds has released a hotfix 15.2.3 HF2 It is suggested to upgrade to the latest hotfix as soon as possible\"}], \"source\": {\"defect\": [\"CVE-2021-35211\"], \"discovery\": \"EXTERNAL\"}, \"work_around\": [{\"lang\": \"en\", \"value\": \"SolarWinds advises to disconnect Serv-U Server from internet until patched.\"}]}}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T00:33:51.183Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit\"}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-35211\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-04T19:06:30.616456Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2021-11-03\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35211\"}}}], \"timeline\": [{\"time\": \"2021-11-03T00:00:00+00:00\", \"lang\": \"en\", \"value\": \"CVE-2021-35211 added to CISA KEV\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-04T19:06:04.170Z\"}}]}",
      "cveMetadata": "{\"assignerOrgId\": \"49f11609-934d-4621-84e6-e02e032104d6\", \"assignerShortName\": \"SolarWinds\", \"cveId\": \"CVE-2021-35211\", \"datePublished\": \"2021-07-14T20:55:25.167Z\", \"dateReserved\": \"2021-06-22T00:00:00.000Z\", \"dateUpdated\": \"2025-07-30T01:38:06.270Z\", \"state\": \"PUBLISHED\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CERTFR-2021-ALE-015

Vulnerability from certfr_alerte

Le 9 juillet 2021, SolarWinds a publié un correctif pour la vulnérabilité CVE-2021-35211 affectant les composants Managed File Transfer et Secure FTP des produits Serv-U avec une version antérieure à 15.2.3 HF2.

Cette vulnérabilité de type "jour zéro" (zero day) a été découverte par Microsoft et permet à un attaquant de pouvoir exécuter du code arbitraire à distance avec des privilèges élevés. Microsoft déclare avoir détecté des exploitations ciblées de cette vulnérabilité.

Cependant, dans le cas où le SSH n'est pas activé sur votre produit SolarWinds Serv-U la vulnérabilité ne peut pas être exploitée.

Solution

Le CERT-FR recommande très fortement d'appliquer le correctif sans délai, voici la procédure à appliquer en fonction de la version de votre produit :

Si vous disposez d'un produit en version 15.2.3 HF1, veuillez appliquer le correctif 15.2.3 HF2 disponible sur le portail client de l'éditeur ;
Si vous disposez d'un produit en version 15.2.3, veuillez appliquer dans un premier temps le correctif 15.2.3 HF1, puis appliquer le correctif 15.2.3 HF2 ;
Si vous disposez d'un produit en version antérieure à 15.2.3, il vous faudra dans un premier temps monter votre produit en version 15.2.3 pour ensuite pouvoir appliquer les correctifs 15.2.3 HF1 puis 15.2.3 HF2.

Informations d'aide à la détection de l'exploitation de cette vulnérabilité

En parallèle, le CERT-FR recommande de faire un contrôle du fichier de journalisation DebugSocketlog.txt. En effet, la vulnérabilité étant de type "Return Oriented Programming attack", son exécution va lever l'exception suivante qui sera dans ce fichier :

bash Xxx xxxxxxx xx:xx:xx - EXCEPTION: C0000005; CSUSSHSocket::ProcessReceive(); Type: 30; puchPayLoad = 0x041ec066; nPacketLength = 76; nBytesReceived = 80; nBytesUncompressed = 156; uchPaddingLength = 5 Exception levée lors de l'exploitation de la CVE-2021-35211

L'éditeur indique cependant que la présence de cette exception n'implique par forcément qu'une exploitation de cette vulnérabilité a été réalisée.

La vérification des connections SSH et TCP est aussi très fortement recommandée. D'après l'éditeur, les connections SSH provenant des IPs suivantes seraient à considérer comme indicateur de compromission : 98.176.196.89, 68.235.178.32. Il en est de même pour les connexions TCP sur le port 443 de l'IP : 208.113.35.58.

Impacted products

	Vendor	Product	Description
	SolarWinds	Serv-U	SolarWinds Serv-U versions antérieures à 15.2.3 HF2

References

Title

Publication Time

Tags

Bulletin de sécurité SolarWinds CVE-2021-35211

2021-07-09

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SolarWinds Serv-U versions ant\u00e9rieures \u00e0 15.2.3 HF2",
      "product": {
        "name": "Serv-U",
        "vendor": {
          "name": "SolarWinds",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "closed_at": "2021-10-19",
  "content": "## Solution\n\n**Le CERT-FR recommande tr\u00e8s fortement d\u0027appliquer le correctif sans\nd\u00e9lai,** voici la proc\u00e9dure \u00e0 appliquer en fonction de la version de\nvotre produit :\n\n-   Si vous disposez d\u0027un produit en version 15.2.3 HF1, veuillez\n    appliquer le correctif 15.2.3 HF2 disponible sur le portail client\n    de l\u0027\u00e9diteur ;\n-   Si vous disposez d\u0027un produit en version 15.2.3, veuillez appliquer\n    dans un premier temps le correctif 15.2.3 HF1, puis appliquer le\n    correctif 15.2.3 HF2 ;\n-   Si vous disposez d\u0027un produit en version ant\u00e9rieure \u00e0 15.2.3, il\n    vous faudra dans un premier temps monter votre produit en version\n    15.2.3 pour ensuite pouvoir appliquer les correctifs 15.2.3 HF1 puis\n    15.2.3 HF2.\n\n\u00a0\n\n### Informations d\u0027aide \u00e0 la d\u00e9tection de l\u0027exploitation de cette vuln\u00e9rabilit\u00e9\n\nEn parall\u00e8le, le CERT-FR recommande de faire un contr\u00f4le du fichier de\njournalisation *DebugSocketlog.txt*. En effet, la vuln\u00e9rabilit\u00e9 \u00e9tant de\ntype \"*Return Oriented Programming attack*\", son ex\u00e9cution va lever\nl\u0027exception suivante qui sera dans ce fichier :\n\n```bash\nXxx xxxxxxx xx:xx:xx - EXCEPTION: C0000005; CSUSSHSocket::ProcessReceive(); Type: 30; puchPayLoad = 0x041ec066; nPacketLength = 76; nBytesReceived = 80; nBytesUncompressed = 156; uchPaddingLength = 5\n```\n*Exception lev\u00e9e lors de l\u0027exploitation de la CVE-2021-35211*\n\nL\u0027\u00e9diteur indique cependant que la pr\u00e9sence de cette exception\nn\u0027implique par forc\u00e9ment qu\u0027une exploitation de cette vuln\u00e9rabilit\u00e9 a\n\u00e9t\u00e9 r\u00e9alis\u00e9e.\n\nLa v\u00e9rification des connections SSH et TCP est aussi tr\u00e8s fortement\nrecommand\u00e9e. D\u0027apr\u00e8s l\u0027\u00e9diteur, les connections SSH provenant des IPs\nsuivantes seraient \u00e0 consid\u00e9rer comme indicateur de compromission :\n98.176.196.89, 68.235.178.32. Il en est de m\u00eame pour les connexions TCP\nsur le port 443 de l\u0027IP : 208.113.35.58.\n\n\u00a0\n\n\u00a0\n",
  "cves": [
    {
      "name": "CVE-2021-35211",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-35211"
    }
  ],
  "initial_release_date": "2021-07-13T00:00:00",
  "last_revision_date": "2021-10-19T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-ALE-015",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-07-13T00:00:00.000000"
    },
    {
      "description": "Cl\u00f4ture de l\u0027alerte. Cela ne signifie pas la fin d\u0027une menace. Seule l\u0027application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l\u0027exploitation de la vuln\u00e9rabilit\u00e9 correspondante.",
      "revision_date": "2021-10-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Le 9 juillet 2021, SolarWinds a publi\u00e9 un correctif pour la\nvuln\u00e9rabilit\u00e9 CVE-2021-35211 affectant les composants *Managed File\nTransfer* et *Secure FTP* des produits Serv-U avec une version\nant\u00e9rieure \u00e0 15.2.3 HF2.\n\nCette vuln\u00e9rabilit\u00e9 de type \"jour z\u00e9ro\" (*zero day*) a \u00e9t\u00e9 d\u00e9couverte\npar Microsoft et permet \u00e0 un attaquant de pouvoir ex\u00e9cuter du code\narbitraire \u00e0 distance avec des privil\u00e8ges \u00e9lev\u00e9s. Microsoft d\u00e9clare\navoir d\u00e9tect\u00e9 des exploitations cibl\u00e9es de cette vuln\u00e9rabilit\u00e9.\n\nCependant, dans le cas o\u00f9 le SSH n\u0027est pas activ\u00e9 sur votre produit\nSolarWinds Serv-U la vuln\u00e9rabilit\u00e9 ne peut pas \u00eatre exploit\u00e9e.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans SolarWinds Serv-U",
  "vendor_advisories": [
    {
      "published_at": "2021-07-09",
      "title": "Bulletin de s\u00e9curit\u00e9 SolarWinds CVE-2021-35211",
      "url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35211"
    }
  ]
}

gsd-2021-35211

Vulnerability from gsd

Modified

2023-12-13 01:23

Details

Aliases

CVE-2021-35211

Aliases

CVE-2021-35211

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-35211",
    "description": "Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.",
    "id": "GSD-2021-35211"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-35211"
      ],
      "details": "Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.",
      "id": "GSD-2021-35211",
      "modified": "2023-12-13T01:23:28.574544Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cisa.gov": {
      "cveID": "CVE-2021-35211",
      "dateAdded": "2021-11-03",
      "dueDate": "2021-11-17",
      "product": "SolarWinds nServ-U",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability.",
      "vendorProject": "SolarWinds",
      "vulnerabilityName": "SolarWinds Serv-U Remote Memory Escape Vulnerability"
    },
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "psirt@solarwinds.com",
        "DATE_PUBLIC": "2021-07-13T16:16:00.000Z",
        "ID": "CVE-2021-35211",
        "STATE": "PUBLIC",
        "TITLE": "Serv-U Remote Memory Escape Vulnerability"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Serv-U Managed File Transfer Server and Serv-U Secured FTP ",
                    "version": {
                      "version_data": [
                        {
                          "platform": "Windows",
                          "version_affected": "\u003c",
                          "version_name": "SolarWinds Serv-U",
                          "version_value": "15.2.3 HF1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "SolarWinds"
            }
          ]
        }
      },
      "credit": [
        {
          "lang": "eng",
          "value": "SolarWinds would like to thank the Microsoft Threat Intelligence Center (MSTIC) and Microsoft Offensive Security Research teams for reporting on the issue in a responsible manner."
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability."
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "impact": {
        "cvss": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": " Memory Escape Vulnerability in Solarwinds Serv-U "
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211",
            "refsource": "MISC",
            "url": "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211"
          },
          {
            "name": "https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit",
            "refsource": "MISC",
            "url": "https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit"
          }
        ]
      },
      "solution": [
        {
          "lang": "eng",
          "value": "SolarWinds has released a hotfix 15.2.3 HF2 It is suggested to upgrade to the latest hotfix as soon as possible "
        }
      ],
      "source": {
        "defect": [
          "CVE-2021-35211"
        ],
        "discovery": "EXTERNAL"
      },
      "work_around": [
        {
          "lang": "eng",
          "value": "SolarWinds advises to disconnect Serv-U Server from internet until patched."
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "15.2.3",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:solarwinds:serv-u:15.2.3:-:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:solarwinds:serv-u:15.2.3:hotfix1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@solarwinds.com",
          "ID": "CVE-2021-35211"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit"
            },
            {
              "name": "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 10.0,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 6.0
        }
      },
      "lastModifiedDate": "2022-07-12T17:42Z",
      "publishedDate": "2021-07-14T21:15Z"
    }
  }
}

ghsa-cpmg-9xq8-3934

Vulnerability from github

Published

2022-05-24 19:07

Modified

2025-10-22 00:32

Severity ?

10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-35211"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-14T21:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.",
  "id": "GHSA-cpmg-9xq8-3934",
  "modified": "2025-10-22T00:32:18Z",
  "published": "2022-05-24T19:07:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35211"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35211"
    },
    {
      "type": "WEB",
      "url": "https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit"
    },
    {
      "type": "WEB",
      "url": "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

fkie_cve-2021-35211

Vulnerability from fkie_nvd

Published

2021-07-14 21:15

Modified

2025-10-22 00:17

Severity ?

9.0 (Critical) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Summary

References

URL	Tags
psirt@solarwinds.com	https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit	Patch, Vendor Advisory
psirt@solarwinds.com	https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211	Patch, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35211

Impacted products

Vendor	Product	Version
solarwinds	serv-u	*
solarwinds	serv-u	15.2.3
solarwinds	serv-u	15.2.3

JSON

To clipboard

{
  "cisaActionDue": "2021-11-17",
  "cisaExploitAdd": "2021-11-03",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "SolarWinds Serv-U Remote Code Execution Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "66A68531-7831-4875-B0AB-215C3E5A62B6",
              "versionEndExcluding": "15.2.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:solarwinds:serv-u:15.2.3:-:*:*:*:*:*:*",
              "matchCriteriaId": "9E8B32A1-90C1-4901-9B66-FA72E5787450",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:solarwinds:serv-u:15.2.3:hotfix1:*:*:*:*:*:*",
              "matchCriteriaId": "92569E9A-911C-4704-A962-047FF5E0E2CF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability."
    },
    {
      "lang": "es",
      "value": "Microsoft descubri\u00f3 una vulnerabilidad de ejecuci\u00f3n de c\u00f3digo remota (RCE) en el producto SolarWinds Serv-U usando una Vulnerabilidad de Escape de Memoria Remota. Si es explotado, un actor de la amenaza puede ser capaz de obtener acceso privilegiado a la m\u00e1quina que aloja Serv-U solamente. SolarWinds Serv-U Managed File Transfer y Serv-U Secure FTP para Windows versiones anteriores a 15.2.3 HF2 est\u00e1n afectados por esta vulnerabilidad"
    }
  ],
  "id": "CVE-2021-35211",
  "lastModified": "2025-10-22T00:17:38.573",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 6.0,
        "source": "psirt@solarwinds.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-07-14T21:15:08.090",
  "references": [
    {
      "source": "psirt@solarwinds.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit"
    },
    {
      "source": "psirt@solarwinds.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35211"
    }
  ],
  "sourceIdentifier": "psirt@solarwinds.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

CERTFR-2021-AVI-516

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans SolarWinds Serv-U. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	SolarWinds	Serv-U	SolarWinds Serv-U versions antérieures à 15.2.3 HF2

References

Title

Publication Time

Tags

Bulletin de sécurité SolarWinds cve-2021-35211 du 09 juillet 2021

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SolarWinds Serv-U versions ant\u00e9rieures \u00e0 15.2.3 HF2",
      "product": {
        "name": "Serv-U",
        "vendor": {
          "name": "SolarWinds",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-35211",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-35211"
    }
  ],
  "initial_release_date": "2021-07-13T00:00:00",
  "last_revision_date": "2021-07-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-516",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-07-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans SolarWinds Serv-U. Elle permet \u00e0\nun attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans SolarWinds Serv-U",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SolarWinds cve-2021-35211 du 09 juillet 2021",
      "url": "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211"
    }
  ]
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2021-35211 (GCVE-0-2021-35211)

Vulnerability from cvelistv5

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

CERTFR-2021-ALE-015

Vulnerability from certfr_alerte

Solution

Informations d'aide à la détection de l'exploitation de cette vulnérabilité

gsd-2021-35211

Vulnerability from gsd

ghsa-cpmg-9xq8-3934

Vulnerability from github

fkie_cve-2021-35211

Vulnerability from fkie_nvd

CERTFR-2021-AVI-516

Vulnerability from certfr_avis

Solution

Tags

Sightings

Nomenclature