SolarWinds Serv-U MFT Server vulnerabilities

2 CVEs affecting SolarWinds Serv-U MFT Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-22428, published 2021-05-05.

More from SolarWinds.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-12181, published 2019-06-17. High severity, CVSS 8.8. EPSS: 65.4% chance of exploitation in the next 30 days. A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux.
• CVE-2020-22428, published 2021-05-05. Medium severity, CVSS 4.8. EPSS: 1.2% chance of exploitation in the next 30 days. SolarWinds Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting (XSS) via a directory name (entered by an admin) containing a JavaScript payload.