Execute Command Function Allows RCE Vulnerability 

(CVE-2021-35223)

Download PDF

Security Advisory Summary

An attacker can abuse the FTP command SITE EXEC for command line obfuscation to conceal the payload which can launch remote code execution (RCE) from the Serv-U Server.

Affected Products

  • Serv-U 15.2.3 and earlier

Fixed Software Release

Acknowledgments

  • Exodus Intelligence (exodusintel.com)

Advisory Details

Severity

8.5 High

Advisory ID

First Published

08/20/2021

Fixed Version

Serv-U 15.2.4

Workarounds

CVSS Score