high7.5
CVE-2018-20684
In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelate…
Impact
In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelated files. This affects TSCPFileSystem::SCPSink in core/ScpFileSystem.cpp.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Winscp | Winscp | through 5.13.7 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/106526
- https://github.com/winscp/winscp/commit/49d876f2c5fc00bcedaa986a7cf6dedd6bf16f54
- https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
- https://winscp.net/eng/docs/history
- https://winscp.net/tracker/1675
- https://www.oracle.com/security-alerts/cpujan2020.html
- http://www.securityfocus.com/bid/106526
- https://github.com/winscp/winscp/commit/49d876f2c5fc00bcedaa986a7cf6dedd6bf16f54
- https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
- https://winscp.net/eng/docs/history
- https://winscp.net/tracker/1675
- https://www.oracle.com/security-alerts/cpujan2020.html