In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelated files. This affects TSCPFileSystem::SCPSink in core/ScpFileSystem.cpp.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Oracle Solaris | — | Upgrade network/ssh to version 7.7.0.1-11.4.7.0.1.3.0 on Solaris 11.4Upgrade consolidation/osnet/osnet-incorporation to version 11.4-11.4.7.0.1.5.0 on Solaris 11.4 | Mar 20, 2019 | Jan 10, 2019 |
| Winscp | — | Upgrade WinSCP to the latest version | Sep 11, 2025 | Jan 10, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub