CVE-2020-22428

MEDIUM 4.8CVE-2020-22428 · Published 05/05/2021 · updated 17/06/2026

In short

CVE-2020-22428 is a MEDIUM (CVSS 4.8) vulnerability affecting serv-u ftp server (solarwinds), serv-u mft server (solarwinds).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 67.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
serv-u ftp server solarwinds	`= 15.1`	No fix yet
serv-u mft server solarwinds	`= 15.1`	No fix yet

Description

SolarWinds Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting (XSS) via a directory name (entered by an admin) containing a JavaScript payload.

References

github.com/matrix · Not Applicable
support.solarwinds.com/SuccessCenter/s/article/Serv-U-15-1-6-Hotfix-3 · Vendor Advisory
twitter.com/gm4tr1x · Third Party Advisory
linkedin.com/in/gabrielegristina · Permissions Required

More vulnerabilities in serv-u ftp server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

In short

CVE-2020-22428 is a MEDIUM (CVSS 4.8) vulnerability affecting serv-u ftp server (solarwinds), serv-u mft server (solarwinds).

Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 67.6% of all vulnerabilities.

No patched version is listed yet: follow the vendor's advisory in References.

Package

Affected versions

Patched versions

serv-u ftp server

solarwinds

= 15.1

No fix yet

serv-u mft server

solarwinds

= 15.1

No fix yet

More vulnerabilities in serv-u ftp server

See all →