PT-2022-11446 · Melag · Melag Ftp Server

Carsten Sandker + 1 · Published 2022-06-24 · Updated 2022-07-05 · CVE-2021-41636

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions MELAG FTP Server version 2.2.0.4

Description The issue allows an attacker to use the CWD command to break out of the FTP server's root directory and operate on the entire operating system. The access restrictions of the user running the FTP server apply.

Recommendations For MELAG FTP Server version 2.2.0.4, consider restricting access to the CWD command as a temporary workaround until a patch is available. Additionally, ensure that the FTP server is run with the least privileges necessary to minimize the impact of a potential exploit. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-41636

Affected Products

Melag Ftp Server

References · 5

• 🔥 https://securesystems.de/blog/advisory-and-exploitation-the-melag-ftp-server · Exploit
• https://osv.dev/vulnerability/CVE-2021-41636 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41636 · Security Note
• https://t.me/cibsecurity/45074 · Telegram Post
• https://t.me/cvenotify/32598 · Telegram Post