CVE-2021-36370 - Vulnerability Details - OpenCVE

An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.01238.

Key SSVC decision points have not yet been added.

Vendors	Products
Midnight-commander	Midnight Commander

Configuration 1 [-]

cpe:2.3:a:midnight-commander:midnight_commander:*:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://docs.ssh-mitm.at/CVE-2021-36370.html
https://github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.c#L484
https://github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.c
https://mail.gnome.org/archives/mc-devel/2021-August/msg00008.html
https://midnight-commander.org/
https://sourceforge.net/projects/mcwin32/files/

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2021-08-30T18:37:23

Updated: 2024-08-04T00:54:51.423Z

Reserved: 2021-07-09T00:00:00

Link: CVE-2021-36370

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-08-30T19:15:08.917

Modified: 2024-11-21T06:13:37.327

Link: CVE-2021-36370

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-09-07T12:31:46", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.c"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.c#L484"}, {"tags": ["x_refsource_MISC"], "url": "https://sourceforge.net/projects/mcwin32/files/"}, {"tags": ["x_refsource_MISC"], "url": "https://midnight-commander.org/"}, {"tags": ["x_refsource_MISC"], "url": "https://docs.ssh-mitm.at/CVE-2021-36370.html"}, {"tags": ["x_refsource_MISC"], "url": "https://mail.gnome.org/archives/mc-devel/2021-August/msg00008.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2021-36370", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.c", "refsource": "MISC", "url": "https://github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.c"}, {"name": "https://github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.c#L484", "refsource": "MISC", "url": "https://github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.c#L484"}, {"name": "https://sourceforge.net/projects/mcwin32/files/", "refsource": "MISC", "url": "https://sourceforge.net/projects/mcwin32/files/"}, {"name": "https://midnight-commander.org/", "refsource": "MISC", "url": "https://midnight-commander.org/"}, {"name": "https://docs.ssh-mitm.at/CVE-2021-36370.html", "refsource": "MISC", "url": "https://docs.ssh-mitm.at/CVE-2021-36370.html"}, {"name": "https://mail.gnome.org/archives/mc-devel/2021-August/msg00008.html", "refsource": "MISC", "url": "https://mail.gnome.org/archives/mc-devel/2021-August/msg00008.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T00:54:51.423Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.c"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.c#L484"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://sourceforge.net/projects/mcwin32/files/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://midnight-commander.org/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://docs.ssh-mitm.at/CVE-2021-36370.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://mail.gnome.org/archives/mc-devel/2021-August/msg00008.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2021-36370", "datePublished": "2021-08-30T18:37:23", "dateReserved": "2021-07-09T00:00:00", "dateUpdated": "2024-08-04T00:54:51.423Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:midnight-commander:midnight_commander:*:*:*:*:*:*:*:*", "matchCriteriaId": "B221D81C-B7C6-4BE6-AEC6-CD700C406BB2", "versionEndIncluding": "4.8.26", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity."}, {"lang": "es", "value": "Se ha detectado un problema en Midnight Commander versiones hasta 4.8.26. Cuando se establece una conexi\u00f3n SFTP, la huella digital del servidor no se comprueba ni se muestra. Como resultado, un usuario se conecta al servidor sin poder verificar su autenticidad."}], "id": "CVE-2021-36370", "lastModified": "2024-11-21T06:13:37.327", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-08-30T19:15:08.917", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://docs.ssh-mitm.at/CVE-2021-36370.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.c#L484"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.c"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://mail.gnome.org/archives/mc-devel/2021-August/msg00008.html"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://midnight-commander.org/"}, {"source": "cve@mitre.org", "tags": ["Product", "Third Party Advisory"], "url": "https://sourceforge.net/projects/mcwin32/files/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://docs.ssh-mitm.at/CVE-2021-36370.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.c#L484"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://mail.gnome.org/archives/mc-devel/2021-August/msg00008.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://midnight-commander.org/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product", "Third Party Advisory"], "url": "https://sourceforge.net/projects/mcwin32/files/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}