Unscored CVE-2018-20684 EUVD-2018-13231GHSA-j599-p537-9c5p

In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially …

Published Jan 10, 2019 · Updated Aug 5, 2024 · Assigned by mitre

Description

In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelated files. This affects TSCPFileSystem::SCPSink in core/ScpFileSystem.cpp.

References

106526 vdb-entry
https://github.com/winscp/winscp/commit/49d876f2c5fc00bcedaa986a7cf6dedd6bf16f54
https://winscp.net/eng/docs/history
https://winscp.net/tracker/1675
https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
https://www.oracle.com/security-alerts/cpujan2020.html