Vulnerability Description
The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local users to bypass authentication in the application and execute code in the context of the Windows SYSTEM account, leading to privilege escalation. To exploit this vulnerability, an attacker must have local access the the host running Serv-U, and a Serv-U administrator have an active management console session.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Solarwinds | Serv-U Ftp Server | 15.1.6.25 |
Related Weaknesses (CWE)
References
- https://seclists.org/fulldisclosure/2019/May/46Mailing ListThird Party Advisory
- https://www.themissinglink.com.au/security-advisories-cve-2018-19999Broken Link
- https://seclists.org/fulldisclosure/2019/May/46Mailing ListThird Party Advisory
- https://www.themissinglink.com.au/security-advisories-cve-2018-19999Broken Link
FAQ
What is CVE-2018-19999?
CVE-2018-19999 is a vulnerability with a CVSS score of 7.8 (HIGH). The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local users to bypass authentication in the application and execute code in the conte...
How severe is CVE-2018-19999?
CVE-2018-19999 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-19999?
Check the references section above for vendor advisories and patch information. Affected products include: Solarwinds Serv-U Ftp Server.