{"id":"CVE-2021-41637","aliases":["EUVD-2021-28650","GHSA-97hx-h624-g753"],"status":"published","title":"Weak access control permissions in MELAG FTP Server 2.2.0.4 allow the \"Everyone\" group to read...","description":"Weak access control permissions in MELAG FTP Server 2.2.0.4 allow the \"Everyone\" group to read the local FTP configuration file, which includes among other information the unencrypted passwords of all FTP users.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00321,"percentile":0.2539,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-276"],"published":"2022-06-24T11:44:42Z","modified":"2026-06-17T04:08:44Z","products":[{"vendor":"melag","product":"ftp_server"}],"references":[{"url":"https://www.securesystems.de/blog/advisory-and-exploitation-the-melag-ftp-server/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41637"},{"url":"https://github.com/advisories/GHSA-97hx-h624-g753"}],"sources":{"cve":[{"id":"CVE-2021-41637","description":"Weak access control permissions in MELAG FTP Server 2.2.0.4 allow the \"Everyone\" group to read the local FTP configuration file, which includes among other information the unencrypted passwords of all FTP users.","status":"published","published":"2022-06-24T11:44:42Z","modified":"2024-08-04T03:15:29.216Z","updated_at":"2026-11-02T14:32:59.105382Z"}],"euvd":[{"id":"EUVD-2021-28650","description":"Weak access control permissions in MELAG FTP Server 2.2.0.4 allow the \"Everyone\" group to read the local FTP configuration file, which includes among other information the unencrypted passwords of all FTP users.","status":"published","published":"2022-06-24T11:44:42Z","modified":"2024-08-04T03:15:29Z","updated_at":"2026-11-03T03:24:17.663217Z"}],"ghsa":[{"id":"GHSA-97hx-h624-g753","title":"Weak access control permissions in MELAG FTP Server 2.2.0.4 allow the \"Everyone\" group to read...","description":"Weak access control permissions in MELAG FTP Server 2.2.0.4 allow the \"Everyone\" group to read the local FTP configuration file, which includes among other information the unencrypted passwords of all FTP users.","status":"published","published":"2022-06-25T00:01:01Z","modified":"2023-01-27T05:04:35Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:42:29.964757Z"}],"nvd":[{"id":"CVE-2021-41637","description":"Weak access control permissions in MELAG FTP Server 2.2.0.4 allow the \"Everyone\" group to read the local FTP configuration file, which includes among other information the unencrypted passwords of all FTP users.","status":"published","published":"2022-06-24T12:15:08.157Z","modified":"2026-06-17T04:08:44.887Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":3.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:07:06.501652Z"}]}}