CVE-2018-16792 SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file that allows an attacker to exfiltrate data.
CriticalCVSS 9.1
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file that allows an attacker to exfiltrate data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| solarwinds sftpscp server | <= 2018-09-10 | No fix listed |
References
- 20181201 SolarWinds SFTP Vulnerabilities mailing-list third-party-advisory