Lucene search

SolarWindsCVELIST:CVE-2023-40053

HistoryDec 06, 2023 - 3:23 a.m.

CVE-2023-40053 HTML injection Vulnerability in Serv-U 15.4

2023-12-0603:23:59

CWE-20

SolarWinds

www.cve.org

cve-2023-40053

serv-u

authenticated actor

content insertion

file share function

malicious

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

AI Score

5.3

Confidence

High

EPSS

Percentile

14.0%

JSON

A vulnerability has been identified within Serv-U 15.4 that allows an authenticated actor to insert content on the file share function feature of Serv-U, which could be used maliciously.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Serv-U",
    "vendor": "SolarWinds",
    "versions": [
      {
        "status": "affected",
        "version": "15.4 and previous versions"
      }
    ]
  }
]

References

documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-4-1_release_notes.htm

www.solarwinds.com/trust-center/security-advisories/CVE-2023-40053

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

AI Score

5.3

Confidence

High

EPSS

Percentile

14.0%

JSON

Related for CVELIST:CVE-2023-40053