{"id":"CVE-2021-35247","aliases":["EUVD-2021-21890","GHSA-jqwj-9jvg-583v"],"status":"published","title":"Improper Input Validation Vulnerability in Serv-U","description":"Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.03642,"percentile":0.89669,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2022-01-07T22:39:50Z","modified":"2026-06-17T03:57:22Z","kev":{"date_added":"2022-01-21","due_date":"2022-02-04","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-01-21"},{"source":"kev","since":"2022-01-21"}],"products":[{"vendor":"solarwinds","product":"serv-u"}],"references":[{"url":"https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35247","tags":["x_refsource_MISC","x_transferred","Broken Link","Vendor Advisory"]},{"url":"https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3_release_notes.htm","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35247","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35247"},{"url":"https://github.com/advisories/GHSA-jqwj-9jvg-583v"}],"sources":{"cve":[{"id":"CVE-2021-35247","title":"Improper Input Validation Vulnerability in Serv-U","description":"Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.","status":"published","published":"2022-01-07T22:39:50.564Z","modified":"2025-10-21T23:15:49.752Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:33:10.204494Z"}],"euvd":[{"id":"EUVD-2021-21890","description":"Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.","status":"published","published":"2022-01-07T22:39:50Z","modified":"2025-10-21T23:15:49Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"exploited_since":"2022-01-21","updated_at":"2026-11-02T20:31:25.901288Z"}],"ghsa":[{"id":"GHSA-jqwj-9jvg-583v","title":"Serv-U web login screen was allowing characters that were not sanitized by the authentication...","description":"Serv-U web login screen was allowing characters that were not sanitized by the authentication mechanism. SolarWinds has updated the authentication mechanism to remedy this issue and prevent unauthorized parameters to be used in the Serv-U login screen With the Log4j issue in the wild, input fields across the internet have been tested for vulnerability. Although Serv-U was not affected by the log4j issue, It was discovered that better input validation could be implemented.","status":"published","published":"2022-01-11T00:01:34Z","modified":"2025-10-22T00:32:27Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:04:05.344883Z"}],"kev":[{"id":"CVE-2021-35247","title":"SolarWinds Serv-U Improper Input Validation Vulnerability","description":"SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization.","cwes":["CWE-20"],"kev":{"date_added":"2022-01-21","due_date":"2022-02-04","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2021-35247","description":"Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.","status":"published","published":"2022-01-10T14:10:17.667Z","modified":"2026-06-17T03:57:22.85Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:03.418194Z"}]}}