CVE-2021-3154: High severity SolarWinds Serv-U vulnerability
An issue was discovered in SolarWinds Serv-U before 15.2.2. Unauthenticated attackers can retrieve cleartext passwords via macro Injection. NOTE: this had a distinct fix relative to CVE-2020-35481.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SolarWinds Serv-Uto a version that resolves this vulnerability.Fixed in 15.2.2
Event History
Frequently Asked Questions
What is CVE-2021-3154?
CVE-2021-3154 is a vulnerability in SolarWinds Serv-U before version 15.2.2, which allows unauthenticated attackers to retrieve cleartext passwords via macro Injection.
How severe is CVE-2021-3154?
CVE-2021-3154 has a severity rating of 7.5 (high).
How can unauthenticated attackers exploit CVE-2021-3154?
Unauthenticated attackers can exploit CVE-2021-3154 to retrieve cleartext passwords via macro Injection.
Is there a fix for CVE-2021-3154?
Yes, the fix for CVE-2021-3154 is available in SolarWinds Serv-U version 15.2.2 and later.
Where can I find more information about CVE-2021-3154?
You can find more information about CVE-2021-3154 in the release notes of SolarWinds Serv-U version 15.2.2.