SolarWinds Sftp/scp Server vulnerabilities

2 CVEs affecting SolarWinds Sftp/scp Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-16792, published 2018-12-05.

More from SolarWinds.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-16791, published 2018-12-05. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. In SolarWinds SFTP/SCP Server through 2018-09-10, the configuration file is world readable and writable, and stores user passwords in an insecure manner, allowing an attacker to determine passwords…
• CVE-2018-16792, published 2018-12-05. Critical severity, CVSS 9.1. EPSS: 1.4% chance of exploitation in the next 30 days. SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file that allows an attacker to exfiltrate data.