CVE-2024-28073: 
Serv-U Managed File Transfer Server vulnerability analysis and mitigation

SolarWinds Serv-U was found to be susceptible to a Directory Traversal Remote Code Vulnerability (CVE-2024-28073), discovered and disclosed on April 17, 2024. This vulnerability affects SolarWinds Serv-U versions 15.4.1.128 and prior versions. The vulnerability was identified by Alexander Skovsende at the Institut for Cyber Risk (Vendor Advisory).

The vulnerability is classified as a Directory Traversal Remote Code Execution vulnerability with a CVSS v3.1 base score of 8.4 (High). The vulnerability is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). According to the technical assessment, the vulnerability requires a highly privileged account to be exploited (NVD, Vendor Advisory).

The vulnerability could potentially allow an attacker with highly privileged account access to perform directory traversal and remote code execution on affected systems. Given the high CVSS score and the potential for both confidentiality and integrity breaches, the impact is considered significant for affected systems (NVD).

The vulnerability requires a highly privileged account for exploitation, which significantly limits its potential abuse. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L), but requires high privileges (PR:H) and user interaction (UI:R) (Vendor Advisory).

SolarWinds has released version 15.4.2 as a fix for this vulnerability. Users of affected versions (15.4.1.128 and prior) are strongly advised to upgrade to the latest version to mitigate the vulnerability (Vendor Advisory).