# CVE-2021-35247

Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.

- Page: https://www.vulneraibility.com/cve/CVE-2021-35247
- CVSS: 4.3
- Known exploited: yes, in CISA KEV since 2022-01-21; CISA due date 2022-02-04
- EPSS: 3.64% (percentile 89.7)
- CISA SSVC: exploitation active, automatable no, technical impact partial (assessed 2025-01-29)
- Weakness: CWE-20
- Published: 2022-01-10

## Affected versions

- SolarWinds Serv-U: affected >= 15.2.5 and previous versions and < 15.3

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35247
- [other] https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3_release_notes.htm
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35247

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.