PT-2022-11447 · Melag · Melag Ftp Server

Carsten Sandker + 1 · Published 2022-06-24 · Updated 2022-07-01 · CVE-2021-41637

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions MELAG FTP Server version 2.2.0.4

Description The issue concerns weak access control permissions that allow the "Everyone" group to read the local FTP configuration file. This file contains unencrypted passwords of all FTP users, among other information.

Recommendations For MELAG FTP Server version 2.2.0.4, consider restricting access to the local FTP configuration file to prevent unauthorized reading of sensitive information, including unencrypted passwords, until a patch or fix is available. As a temporary workaround, restrict the "Everyone" group's permissions to minimize the risk of exploitation.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2021-41637

Affected Products

Melag Ftp Server

References · 4

• 🔥 https://securesystems.de/blog/advisory-and-exploitation-the-melag-ftp-server · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-41637 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41637 · Vendor Advisory
• https://t.me/cibsecurity/45073 · Telegram Post