|Date: (C)2012-10-10 (M)2017-08-29|
|CVSS Score: 5.1||Access Vector: NETWORK|
|Exploitability Subscore: 4.9||Access Complexity: HIGH|
|Impact Subscore: 6.4||Authentication: NONE|
| ||Confidentiality: PARTIAL|
| ||Integrity: PARTIAL|
| ||Availability: PARTIAL|
Midnight Commander (mc) 4.8.5 does not properly handle the (1) MC_EXT_SELECTED or (2) MC_EXT_ONLYTAGGED environment variables when multiple files are selected, which allows user-assisted remote attackers to execute arbitrary commands via a crafted file name.