There is a new Serv-U vulnerability found by Microsoft, related to attacks being propagated via a previously undisclosed vulnerability in the SolarWinds Serv-U software. The vulnerability tracked as CVE2021-35247 is an input validation vulnerability that could allow attackers to build a query based on given input, and send it over the network without sanitation.

Serv-U, users can be authenticated against an internal LDAP server, such as a Windows domain controller or OpenLDAP serve.

As per SolarWinds,the attemps to login to Serv-U using the Log4j vulnerability failed, as Serv-U does not utilize Log4j code and the target for authentication LDAP (Microsoft Active Directory) is not susceptible to Log4J attacks.

Table 1: Vulnerability details 

                                                                                       Table 2: Vulnerable versions