Vulnerability Description
In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelated files. This affects TSCPFileSystem::SCPSink in core/ScpFileSystem.cpp.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Winscp | Winscp | <= 5.13.7 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/106526Third Party AdvisoryVDB Entry
- https://github.com/winscp/winscp/commit/49d876f2c5fc00bcedaa986a7cf6dedd6bf16f54PatchThird Party Advisory
- https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txtMitigationThird Party Advisory
- https://winscp.net/eng/docs/historyRelease NotesVendor Advisory
- https://winscp.net/tracker/1675PatchVendor Advisory
- https://www.oracle.com/security-alerts/cpujan2020.html
- http://www.securityfocus.com/bid/106526Third Party AdvisoryVDB Entry
- https://github.com/winscp/winscp/commit/49d876f2c5fc00bcedaa986a7cf6dedd6bf16f54PatchThird Party Advisory
- https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txtMitigationThird Party Advisory
- https://winscp.net/eng/docs/historyRelease NotesVendor Advisory
- https://winscp.net/tracker/1675PatchVendor Advisory
- https://www.oracle.com/security-alerts/cpujan2020.html
FAQ
What is CVE-2018-20684?
CVE-2018-20684 is a vulnerability with a CVSS score of 7.5 (HIGH). In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelated files. This affects TSCPFileSystem::SCP...
How severe is CVE-2018-20684?
CVE-2018-20684 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-20684?
Check the references section above for vendor advisories and patch information. Affected products include: Winscp Winscp.