Path Traversal (CVE‑2024‑28995) in SolarWinds Serv‑U Allows Unauthorized File Reads
What It Is — SolarWinds Serv‑U FTP server contains a path‑traversal flaw (CVE‑2024‑28995) that lets an unauthenticated attacker read arbitrary files on the host system. The issue arises from insufficient validation of user‑supplied file paths.
Exploitability — Publicly disclosed; no public exploit code yet, but the vulnerability is trivial to weaponize. NVD assigns a CVSS v3.1 base score of 7.8 (High).
Affected Products — SolarWinds Serv‑U (all supported versions prior to the vendor‑released patch on 2024‑09‑10).
Why It Matters for Trust & Control Assurance
- Highlights a gap in the Access Control – Least Privilege control objective, which maps to many frameworks (e.g., NIST CSF, ISO 27001).
- Underscores the need for continuous control‑mapping and evidence collection to prove due‑diligence during audits.
- Demonstrates why a centralized Trust Center with up‑to‑date remediation evidence is critical for defensible audit trails.
Recommended Actions
- Apply SolarWinds’ patch immediately and verify the installed version.
- Review and harden file‑access controls on all Serv‑U instances to block directory traversal.
- Record remediation steps in your Trust Center to provide audit‑ready evidence.
- Integrate this control‑mapping check into your continuous monitoring program.
Source: CISA KEV – CVE‑2024‑28995