CVE-2018-20685

5.3

MEDIUMCVSS v3

Published

January 10, 2019

CVSS v2

2.6 LOW

Affected

3 projects

Assigned by

MITRE

Severity scale

010

Description

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.

openssh/openssh-portable

GitHubPortable OpenSSH

NVD

winscp/winscp

GitHubWinSCP is a popular free file manager for Windows supporting SFTP, FTP, FTPS, SCP, S3, WebDAV and local-to-local file transfers. A powerful tool to enhance your productivity with a user-friendly interface and automation options like .NET assembly.

<= 5.13NVD

WinSCP

NuGet Gallery

More on this CVE

NVD↗GitHub Advisory↗

The WinSCP .NET assembly is a .NET wrapper around WinSCP’s scripting interface that allows your code to connect to a remote machine and manipulate remote files over SFTP, FTP, WebDAV, S3 and SCP sessions. The library is primarily intended for advanced automation tasks on Microsoft Windows that require conditional processing, loops or other control structures for which the basic scripting interface is too limited. The library is not a general purpose file transfer library. It particularly has a limited support for an interactive processing, and as such it is not well suited for use in GUI applications. For the same reason it is also difficult to use the assembly within a restricted environment like a web server, that limits or even restricts execution of external processes. For documentation and examples of use, see project website. The NuGet package includes the assembly itself and a required WinSCP executable. When installed, it adds the assembly as reference to your project and sets up WinSCP executable to be copied to project output directory, so that it can be found on run-time.

<= 5.13NVD

Security Advisories

CVE-2018-20685

Description

More on this CVE