233
VMScore

CVE-2021-36368

Published: 13/03/2022 Updated: 11/04/2024
CVSS v2 Base Score: 2.6 | Impact Score: 2.9 | Exploitability Score: 4.9
CVSS v3 Base Score: 3.7 | Impact Score: 1.4 | Exploitability Score: 2.2
VMScore: 233
Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N

Vulnerability Summary

An issue exists in OpenSSH prior to 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user's behalf. NOTE: the vendor's position is "this is not an authentication bypass, since nothing is being bypassed.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

openbsd openssh

debian debian linux 9.0

debian debian linux 10.0

debian debian linux 11.0

Github Repositories

Nmap's XML result parse and NVD's CPE correlation to search CVE.

CrowFlag This script analyses the Nmap XML scanning results, parses each CPE context and correlates to search CVE on NIST You can use that to find public vulnerabilities in services View Code · Report Bug · View Wiki Getting Started: Before we start Tested using python 3615 (for manual installation) If any error rai

SSH-MITM - ssh audits made simple ssh man-in-the-middle (ssh-mitm) server for security audits supporting publickey authentication, session hijacking and file manipulation Contributors Table of Contents Introduction Features Installation Quickstart Session hijacking Phishing FIDO Tokens Contributing Contact Introduction

SSH-MITM - ssh audits made simple ssh man-in-the-middle (ssh-mitm) server for security audits supporting publickey authentication, session hijacking and file manipulation Contributors Table of Contents Introduction Features Installation Quickstart Session hijacking Phishing FIDO Tokens Contributing Contact Introduction

SSH-MITM - ssh audits made simple ssh man-in-the-middle (ssh-mitm) server for security audits supporting publickey authentication, session hijacking and file manipulation Explore the docs » Table of Contents Introduction Features Installation Quickstart Session hijacking Publickey authentication Contributing Introduction

SSH-MITM - ssh audits made simple ssh man-in-the-middle (ssh-mitm) server for security audits supporting publickey authentication, session hijacking and file manipulation Contributors Table of Contents Introduction Features Installation Quickstart Session hijacking Phishing FIDO Tokens Contributing Contact Introduction

SSH-MITM - ssh audits made simple

SSH-MITM - ssh audits made simple ssh man-in-the-middle (ssh-mitm) server for security audits supporting publickey authentication, session hijacking and file manipulation         Contributors Table of Contents Introduction Features Installation Quickstart Session hi

SSH-MITM - ssh audits made simple ssh man-in-the-middle (ssh-mitm) server for security audits supporting publickey authentication, session hijacking and file manipulation Explore the docs » Table of Contents Introduction Features Installation Quickstart Session hijacking Phishing FIDO Tokens Contributing Introduction S

SSH-MITM Server SSH-MITM is a man in the middle (mitm) server for security audits supporting public key authentication, session hijacking and file manipulation Installation SSH-MITM The first step to using any software package is getting it properly installed To install SSH-MITM, simply run this simple command in your terminal of choice: $ pip install ssh-mitm