title: 2FA/MFA Bypass Vulnerability in Serv-U 15.4 and 15.4 Hotfix 1
description: A vulnerability has been identified within Serv-U 15.4 and 15.4 Hotfix 1 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action.
15.4.  SolarWinds found that the issue was not completely fixed in 15.4 Hotfix 1.
problem types: CWE-284: Improper Access Control
affected:
{
defaultStatus: affected
product: Serv-U
vendor: SolarWinds
versions:
lessThanOrEqual: 15.4 Hotfix 1 , status: affected, version: 15.4, versionType: hotfix
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: All SolarWinds Serv-U customers are advised to upgrade to the latest version of the SolarWinds Serv-U version 15.4 Hotfix 2