CVE-2021-35242

Serv-U server responds with valid CSRFToken when the request contains only Session.

CVE-2021-35245

When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine.