Path traversal in Serv-U FTP Server - CVE-2024-28995
Published: June 7, 2024 / Updated: July 26, 2024
Vulnerability identifier: #VU91290
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-28995
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted request and read arbitrary files on the system.
Affected software
Serv-U FTP Server
How to mitigate CVE-2024-28995
Install update from vendor's website.
Serv-U FTP Server - update to 15.4.2 Hotfix 2
Links to Public Exploits and PoC-codes
- Exploit #10251 - CVE-2024-28995 (July 26, 2024)
- Exploit #10186 - CVE-2024-28995 (July 5, 2024)
- Exploit #10140 - CVE-2024-28995-SolarWinds-Serv-U (Exploit for CVE-2024-28995 affecting SolarWinds Serv-U 15.4.2 HF 1 and previous versions) (June 28, 2024)
- Exploit #10076 - CVE-2024-28995 (June 21, 2024)
- Exploit #10005 - SolarWinds Serv-U Unauthenticated Arbitrary File Read (June 19, 2024)
- Exploit #9978 - CVE-2024-28995-Nuclei-Template (June 14, 2024)
- Exploit #9977 - CVE-2024-28995 (June 14, 2024)
- Exploit #9976 - CVE-2024-28995 (June 14, 2024)
- Exploit #9975 - cves (June 14, 2024)