CVE-2021-35223CWE-20

Execute Command Function Allows Remote Code Execution (RCE)Vulnerability

High · published August 31, 2021

CVSS v3.1
8.5
EPSS
3%
Percentile
87.0
In the wild
Unconfirmed
What it is

The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables, allowing remote code execution.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02939 · 87.0th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2021-08-31T16:00Z
EPSS history
Timeline
  • 31 AUG 16:00Z
    Execute Command Function Allows Remote Code Execution (RCE)Vulnerability
    cvelistv5