CVE-2023-40053— HTML injection Vulnerability in Serv-U 15.4
Quick assessment
Affected
SolarWinds Serv-U
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SolarWinds Serv-U FTP Server是美国SolarWinds公司的一套FTP和MFT文件传输软件。 SolarWinds Serv-U FTP Server 15.4版本存在输入验证错误漏洞，该漏洞源于允许经过身份验证的攻击者在file share功能上插入内容，该内容可能会被恶意使用。
Possible ATT&CK Techniques 1 AI
T1565.003 · Runtime Data Manipulation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-40053
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HTML injection Vulnerability in Serv-U 15.4
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been identified within Serv-U 15.4 that allows an authenticated actor to insert content on the file share function feature of Serv-U, which could be used maliciously.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
SolarWinds Serv-U FTP Server 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SolarWinds Serv-U FTP Server是美国SolarWinds公司的一套FTP和MFT文件传输软件。 SolarWinds Serv-U FTP Server 15.4版本存在输入验证错误漏洞，该漏洞源于允许经过身份验证的攻击者在file share功能上插入内容，该内容可能会被恶意使用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SolarWinds | Serv-U | 15.4 and previous versions | - |
|
II. Public POCs for CVE-2023-40053
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-40053
请登录查看更多情报信息。
Other References for CVE-2023-40053 (2)
IV. Related Vulnerabilities
Same product: Serv-U
-
CVE-2026-28321
SolarWinds Serv-U Broken Access Control Vulnerability -
CVE-2026-28317
SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vu -
CVE-2026-28316
SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vu -
CVE-2026-28315
SolarWinds Serv-U Authenticated Stored Cross-site Scripting -
CVE-2026-28314
SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vu
Same vendor: SolarWinds
-
CVE-2026-28325
SolarWinds Observability Self-Hosted Unauthenticated Remote -
CVE-2026-28324
SolarWinds Observability Self-Hosted Remote Code Execution V -
CVE-2026-28326
SolarWinds Access Rights Manager Unauthenticated Remote Code -
CVE-2026-28323
SolarWinds Web Help Desk SAML Authentication Bypass Vulnerab -
CVE-2026-28321
SolarWinds Serv-U Broken Access Control Vulnerability
Same weakness: CWE-20
-
CVE-2026-107734
SumatraPDF: SyncTeX Argument Injection in Inverse Search Ena -
CVE-2026-107726
Hazelcast: Arbitrary member memory access by low-privileged -
CVE-2026-107720
fast-jwt: createVerifier accepts unsigned JWTs when key is ' -
CVE-2026-107717
Banks: User-controlled prompt input can be parsed as privile -
CVE-2026-88257
beam_mcp: nested tool argument constraints advertised but no
V. Comments for CVE-2023-40053
No comments yet