by Kastro
Paper/Archive/CVE-2021-3331

CVE-2021-3331

mitre — WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads sess…

EPSS 8%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 94.6.946 × 2018.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwinscp.net/eng/docs/history#5.17.10refwinscp.net/tracker/1943refgithub.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688drefwinscp.net/eng/docs/rawsettings