---
id: 4227
title: "[CVE-2018-10240] SolarWinds Serv-U Managed File Transfer – Insufficient Session ID Entropy"
cve: CVE-2018-10240
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/solarwinds-serv-u-mft-advisory"
published_at: "2018-05-14T00:00:00Z"
tags: ["brute-force", "solarwinds", "session-hijacking", "serv-u", "vulnerability-advisory", "cve-2018-10240"]
phying_url: "https://phying.com/item/4227"
lang: en
---

# [CVE-2018-10240] SolarWinds Serv-U Managed File Transfer – Insufficient Session ID Entropy

## Summary

SolarWinds Serv-U MFT 15.1.6.25 issues low-entropy integer session tokens usable in URLs; a brute-forced value hijacks sessions after only 4,780 guesses (CVE-2018-10240).

## Intelligence Metadata

- **Sources:** bishopfox.com
- **CVE:** CVE-2018-10240
- **Published:** 2018-05-14T00:00:00Z
- **Original:** https://bishopfox.com/blog/solarwinds-serv-u-mft-advisory
- **Phying News:** https://phying.com/item/4227