Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

Directory Traversal Vulnerability in SolarWinds Serv-U

Security update addresses a vulnerability that could lead to unauthorised access of confidential files

Threat ID:
CC-4507
Threat Severity:
Medium
Published:
7 June 2024 2:51 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security update addresses a vulnerability that could lead to unauthorised access of confidential files

Affected platforms

The following platforms are known to be affected:

Versions: all prior to 15.4.2 Hotfix 2

SolarWinds Serv-U

Threat details

Introduction

SolarWinds has released a security update to address a directory traversal vulnerability in Serv-U, a managed file transfer (MFT) platform. An unauthorised attacker could exploit this vulnerability to access and read confidential files on a host device. This vulnerability is rated as high with a CVSSv3 score of 8.6.

Active Exploitation of CVE-2024-28995

A public proof-of-concept is available for this vulnerability and security researchers have observed exploitation attempts in the wild.

Threat updates

Date Update
19 Jun 2024 Exploitation and proof-of-concept of CVE-2024-28995

Remediation advice

Affected organisations are encouraged to review the SolarWinds Serv-U Directory Transversal Vulnerability (CVE-2024-28995) advisory and apply any necessary updates. 

Last edited: 19 June 2024 11:03 am