PT-2022-11449 · Melag · Melag Ftp Server

Carsten Sandker + 1 · Published 2022-06-24 · Updated 2022-07-01 · CVE-2021-41639

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MELAG FTP Server version 2.2.0.4

Description The issue concerns the storage of unencrypted passwords of FTP users in a local configuration file.

Recommendations For MELAG FTP Server version 2.2.0.4, consider updating the configuration to encrypt stored passwords or restrict access to the configuration file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2021-41639

Affected Products

Melag Ftp Server

References · 4

• 🔥 https://securesystems.de/blog/advisory-and-exploitation-the-melag-ftp-server · Exploit
• https://osv.dev/vulnerability/CVE-2021-41639 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41639 · Security Note
• https://t.me/cibsecurity/45077 · Telegram Post