CVE-2020-35482: 
Serv-U Managed File Transfer Server vulnerability analysis and mitigation

SolarWinds Serv-U before version 15.2.2 was found to contain a reflected Cross-Site Scripting (XSS) vulnerability that affects authenticated users. The vulnerability was assigned CVE-2020-35482 and was disclosed in February 2021 (NVD, CVE Details).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction. The scope is changed with low confidentiality and integrity impact, and no availability impact (NVD).

The vulnerability allows authenticated users to perform reflected cross-site scripting attacks, potentially leading to unauthorized access to sensitive information and the ability to perform actions on behalf of other users (NVD).

The vulnerability requires authentication to exploit, meaning an attacker must first have valid credentials to the Serv-U system. The attack complexity is considered low, indicating that the vulnerability is relatively straightforward to exploit once authentication is achieved (NVD).

The vulnerability was addressed in SolarWinds Serv-U version 15.2.2. Users are advised to upgrade to this version or later to mitigate the risk (Release Notes).