Lucene search

SolarWindsVULNRICHMENT:CVE-2022-38106

HistoryDec 16, 2022 - 12:00 a.m.

CVE-2022-38106 Cross-Site Scripting Vulnerability in Serv-U Web Client

2022-12-1600:00:00

CWE-79

SolarWinds

github.com

cve-2022-38106

serv-u

web client

xss

vulnerability

directory creation.

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

This vulnerability happens in the web client versions 15.3.0 to Serv-U 15.3.1. This vulnerability affects the directory creation function.

CNA Affected

[
  {
    "vendor": "SolarWinds",
    "product": "Serv-U File Server",
    "versions": [
      {
        "status": "affected",
        "version": "15.3.0"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

cve.mitre.org/cgi-bin/cvename.cgi?name=%20CVE-2022-38106

documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3-2_release_notes.htm

www.solarwinds.com/trust-center/security-advisories/CVE-2022-38106