CVE-2021-36370

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://docs.ssh-mitm.at/CVE-2021-36370.htmlExploit, Third Party Advisory
https://github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.c#L484Exploit, Third Party Advisory
https://github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.cExploit, Third Party Advisory
https://mail.gnome.org/archives/mc-devel/2021-August/msg00008.htmlRelease Notes, Third Party Advisory
https://midnight-commander.org/Vendor Advisory
https://sourceforge.net/projects/mcwin32/files/Product, Third Party Advisory
https://docs.ssh-mitm.at/CVE-2021-36370.htmlExploit, Third Party Advisory
https://github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.c#L484Exploit, Third Party Advisory
https://github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.cExploit, Third Party Advisory
https://mail.gnome.org/archives/mc-devel/2021-August/msg00008.htmlRelease Notes, Third Party Advisory
https://midnight-commander.org/Vendor Advisory
https://sourceforge.net/projects/mcwin32/files/Product, Third Party Advisory

Timeline

Published: Aug 30, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-363713.7Emissary-Ingress (formerly Ambassador API Gateway) through 1.13.9 allows attackers to bypass client certificate requirements (i.e., mTLS cer CVE-2021-363729.8In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with a CVE-2021-363735.5When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an ou CVE-2021-363745.5When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that CVE-2021-363767.8dandavison delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory.CVE-2021-363777.5Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation.CVE-2021-36386.5An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while ha CVE-2021-363809.8Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDia CVE-2021-363815.3In Edifecs Transaction Management through 2021-07-12, an unauthenticated user can inject arbitrary text into a user's browser via logon.jsp?CVE-2021-363823.7Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack aga CVE-2021-363834.3Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket reso CVE-2021-363859.8A SQL Injection vulnerability in Cerner Mobile Care 5.0.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via a Fu