CVE-2024-45712

SolarWinds Serv-U Client-Side Cross-Site Scripting Vulnerability

State: Published
Severity: 2.6 Low
Published: Apr 15, 2025
Updated: Apr 15, 2025
Reserved: Sep 5, 2024

Description

SolarWinds Serv-U is vulnerable to a client-side cross-site scripting (XSS) vulnerability. The vulnerability can only be performed by an authenticated account, on the local machine, from the local browser session. Therefore the risk is very low.

Scores

CVSS	Score	Vector	Source
3.1	2.6 Low	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N	SolarWinds

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
Serv-USolarWinds	Serv-U 15.5 and previous versionsAffected

References

https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45712
https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-1_release_notes.htm

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.