CVE-2021-41636 — MEDIUM (6.5)

Vulnerability Description

MELAG FTP Server 2.2.0.4 allows an attacker to use the CWD command to break out of the FTP servers root directory and operate on the entire operating system, while the access restrictions of the user running the FTP server apply.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Melag	Ftp Server	2.2.0.4

Related Weaknesses (CWE)

CWE-22

References

https://www.securesystems.de/blog/advisory-and-exploitation-the-melag-ftp-serverExploitMitigationThird Party Advisory
https://www.securesystems.de/blog/advisory-and-exploitation-the-melag-ftp-serverExploitMitigationThird Party Advisory

FAQ

What is CVE-2021-41636?

CVE-2021-41636 is a vulnerability with a CVSS score of 6.5 (MEDIUM). MELAG FTP Server 2.2.0.4 allows an attacker to use the CWD command to break out of the FTP servers root directory and operate on the entire operating system, while the access restrictions of the user ...

How severe is CVE-2021-41636?

CVE-2021-41636 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-41636?

Check the references section above for vendor advisories and patch information. Affected products include: Melag Ftp Server.