CVE-2022-38337: Critical severity mobaxterm vulnerability
When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid login attempt which can result in a Denial of Service (DoS) for the user if services like fail2ban are used.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-38337?
CVE-2022-38337 is considered a medium severity vulnerability due to its potential for causing Denial of Service (DoS) conditions.
How do I fix CVE-2022-38337?
To fix CVE-2022-38337, upgrade MobaXterm to version 22.3 or later.
What kind of exploit is associated with CVE-2022-38337?
CVE-2022-38337 may be exploited to trigger Denial of Service (DoS) by repeatedly aborting SFTP connections.
Who is affected by CVE-2022-38337?
CVE-2022-38337 affects users of MobaXterm versions prior to 22.3 who use SFTP connections.
Can CVE-2022-38337 impact my server?
Yes, CVE-2022-38337 can lead to invalid login attempts that may result in IP blocks by security mechanisms like fail2ban.