CVE-2020-28001: 
Serv-U Managed File Transfer Server vulnerability analysis and mitigation

SolarWinds Serv-U before version 15.2.2 contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2020-28001. The vulnerability was discovered on October 30, 2020, and was fixed with the release of version 15.2.2 on January 21, 2021. This security flaw affects the SolarWinds Serv-U FTP Server software (SolarWinds Advisory, Missing Link).

The vulnerability exists due to improper sanitization and validation of user-supplied directory names in the Serv-U FTP server. When malicious users create directories with specifically crafted names, clicking on these directory names in the breadcrumb menu triggers XSS payloads. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

Successful exploitation of this vulnerability could allow an authenticated attacker to perform unauthorized actions in the user's security context, potentially leading to the compromise of sensitive information or execution of malicious actions on behalf of the victim (Missing Link).

The vulnerability requires authentication and user interaction to be exploited. A proof of concept exists demonstrating that an attacker can create a directory with a specially crafted name containing JavaScript code that executes when clicked in the breadcrumb menu (Full Disclosure).

The recommended mitigation is to upgrade to SolarWinds Serv-U version 15.2.2 or later, which contains fixes for this vulnerability (SolarWinds Advisory).