Description
SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the application as a URL parameter in lieu of a session cookie. This session token's value can be brute-forced by an attacker to obtain the corresponding session cookie and hijack the user's session.
Scores
CVSS v3
7.3
EPSS
0.0135
EPSS Percentile
80.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Details
CWE
CWE-331
Status
published
Products (1)
solarwinds/serv-u
< 15.1.6
Published
May 16, 2018
Tracked Since
Feb 18, 2026