CVE-2024-45301
MEDIUM EPSS 15.9%
Published Nov 12, 20257mo ago · Modified Jun 17, 20262w ago
5.3 CVSS 3.1
Published Nov 12, 2025 7mo ago
Last Modified Jun 17, 2026 2w ago
Description
Mintty is a terminal emulator for Cygwin, MSYS, and WSL. In versions 2.3.6 through 3.7.4, several escape sequences can cause the mintty process to access a file in a specific path. It is triggered by simply printing them out on bash. An attacker can specify an arbitrary network path, negotiate an ntlm hash out of the victim's machine to an attacker controlled remote host. An attacker can use password cracking tools or NetNTLMv2 hashes to Pass the Hash. Version 3.7.5 fixes the issue.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity None
Availability None
Threat Intelligence
EPSS Exploit Probability
15.9% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-20 Improper Input Validation Validation
References 1
- github.com https://github.com/mintty/mintty/security/advisories/GHSA-jf4m-m6rv-p6c5
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.