CVE-2021-35247Improper Input Validation Vulnerability in Serv-U

Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.

5.3 MEDIUMEPSS 3.64%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-06-17 03:57 UTC

OverviewCVSS details

5.3MEDIUMCVSS 3.1

Score source: NVD
NVD status: Analyzed
Published: Jan 10, 2022
Assigner: SolarWinds

Affected

Serv-U (SolarWinds)

Versions: 15.2.5 and previous versions before 15.3
Fixed in: 15.3

Exploitation

Public exploit: None listed
CISA KEV: Listed · Jan 21, 2022
KEV due date: Feb 4, 2022
Ransomware use: Unknown
SSVC: Exploitation active · Automatable no · Impact partial

EPSS · FIRST, scored Nov 7

3.64%chance of exploitation in 30 days

Higher than 89.64% of CVEs

CVSS 3.1 · NVD

5.3Medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: None
Integrity impact: Low
Availability impact: None

CVSS 3.1 · SolarWinds (CNA)

4.3Medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality impact: None
Integrity impact: Low
Availability impact: None

CVSS 2.0 · NVD

5.0Medium

AV:N/AC:L/Au:N/C:N/I:P/A:N

Attack vector: Network
Attack complexity: Low
Authentication: None
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
5.3	MEDIUM	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
4.3	MEDIUM	3.1SolarWinds (CNA)	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
5.0	MEDIUM	2.0NVD	AV:N/AC:L/Au:N/C:N/I:P/A:N

CISA required action

⚡ Known exploited · remediation due Feb 4, 2022

Apply updates per vendor instructions.

Details

CVE ID: CVE-2021-35247
Status: Analyzed
Assigner (CNA): SolarWinds
Published: Jan 10, 2022
Last modified: 2026-06-17 03:57 UTC
Weaknesses: CWE-20 · Improper Input Validation

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 11:29 UTC.