What is CVE-2018-19999?

CVE-2018-19999 is a high-severity vulnerability in Solarwinds Serv-u_ftp_server, classified under Improper Authentication. CVSS score: 7.8/10. Published 2019-06-07.

How severe is CVE-2018-19999?

High severity. CVSS v3 base score is 7.8 out of 10.

Auth bypass in Solarwinds Serv-u_ftp_server

CVE-2018-19999

The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local users to bypass authentication in the application and execute code in the context of the Windows SYSTEM account, leadi…

Vulnerability class: Broken Authentication

EPSS: 0.006 (45.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Solarwinds Serv-u_ftp_server — versions 15.1.6.25
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

cve@mitre.org (x_refsource_MISC, Broken Link)
cve@mitre.org (Mailing List, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-19999?: CVE-2018-19999 is a high-severity vulnerability in Solarwinds Serv-u_ftp_server, classified under Improper Authentication. CVSS score: 7.8/10. Published 2019-06-07.
How severe is CVE-2018-19999?: High severity. CVSS v3 base score is 7.8 out of 10.