CVE-2018-19999

🗓️ 07 Jun 2019 16:13:37Reported by mitreType

cve🔗 web.nvd.nist.gov👁 81 Views🌐 WEB

The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls, allowing local users to bypass authentication and execute code in the context of the Windows SYSTEM account, leading to privilege escalation

Reporter	Title	Published	Views	Family All 10
0day.today	Serv-U FTP Server 15.1.6.25 Local Privilege Escalation Vulnerability	30 May 201900:00	–	zdt
Circl	CVE-2018-19999	7 Jun 201921:03	–	circl
CNVD	Serv-U FTP Server Elevation of Privilege Vulnerability	31 May 201900:00	–	cnvd
Cvelist	CVE-2018-19999	7 Jun 201916:13	–	cvelist
EUVD	EUVD-2018-11661	7 Oct 202500:30	–	euvd
NVD	CVE-2018-19999	7 Jun 201917:29	–	nvd
OSV	CVE-2018-19999	7 Jun 201917:29	–	osv
Packet Storm	Serv-U FTP Server 15.1.6.25 Local Privilege Escalation	30 May 201900:00	–	packetstorm
Prion	Authentication flaw	7 Jun 201917:29	–	prion
RedhatCVE	CVE-2018-19999	22 May 202512:57	–	redhatcve

NVD

Node

solarwinds serv-u_ftp_serverMatch15.1.6.25

Source	Link
themissinglink	www.themissinglink.com.au/security-advisories-cve-2018-19999
seclists	www.seclists.org/fulldisclosure/2019/May/46

Parameter	Position	Path	Description	CWE
Session	query param	/?Session=XXXXX&Language=en,US&LocalAdmin=1	Authentication bypass leading to privilege escalation via local access to Serv-U FTP HTTP interface using Session parameter to bypass login	CWE-287

21 Nov 2024 03:58Current

7.7High risk

Vulners AI Score7.7

CVSS 27.2

CVSS 37.8

EPSS0.00056

CWE-287