Partner with Censys and empower customers with the Internet context that powers the modern SOC. The Censys Partner Program offers opportunities to expand your reach, with support from Censys every step of the way.
Threat, vulnerability, and Internet intelligence built from expansive first-party visibility. The mission: to illuminate Internet behaviors that impact our world.
Partner with Censys and empower customers with the Internet context that powers the modern SOC. The Censys Partner Program offers opportunities to expand your reach, with support from Censys every step of the way.
Threat, vulnerability, and Internet intelligence built from expansive first-party visibility. The mission: to illuminate Internet behaviors that impact our world.
CVE-ID and CVSS Score: CVE-2024-28995 (CVSS Score 7.5)
Issue Name and Description: SolarWinds Serv-U Path Traversal Vulnerability
Asset Description: SolarWinds Serv-U is a multi-protocol file server that allows users to send and receive files from other networked computers. This affects versions 15.4.2 and earlier.
Vulnerability Impact: SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
Exploitation Details:
According to CISA this vulnerability has been exploited in the wild and is classified as a KEV. GreyNoise has also reported widespread exploitation.
Patch Availability:
SolarWinds has patched this CVE in SolarWinds Serv-U 15.4.2 Hotfix 2.
Detection with Censys: The following queries can be leveraged to identify all Censys-visible public-facing Serv-U instances. Note that the Search and ASM queries do not pinpoint vulnerable versions.
