High severity · published Jan 10, 2019
CVE-2018-20684
In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelated files
7.5
CVSS
2.8%
EPSS
No
On KEV
Description
In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelated files. This affects TSCPFileSystem::SCPSink in core/ScpFileSystem.cpp.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
Winscp · Winscp
through 5.13.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-20684
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-20684
Third Party Advisory
http://www.securityfocus.com/bid/106526
Patch
https://github.com/winscp/winscp/commit/49d876f2c5fc00bcedaa986a7cf6dedd6bf16f54
Mitigation
https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
Release Notes
https://winscp.net/eng/docs/history
Patch
https://winscp.net/tracker/1675
www.oracle.com
https://www.oracle.com/security-alerts/cpujan2020.html
More from Winscp
9.8
CVE-2021-3331
WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings
9.8
CVE-2020-28864
Buffer overflow in WinSCP 5.17.8 allows a malicious FTP server to cause a denial of service or possibly have other unspecified impact via a long file name
6.8
CVE-2019-6110
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for…
6.8
CVE-2019-6109
An issue was discovered in OpenSSH 7.9
5.9
CVE-2024-31497
In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60…