PT-2006-3920 · Winscp · Winscp

Jelmer Kuperus

·

CVE-2006-3015

·

Published

2006-06-14

·

Updated

2024-02-13

CVSS v2.0

7.1

High

VectorAV:N/AC:H/Au:N/C:C/I:C/A:N
Name of the Vulnerable Software and Affected Versions WinSCP version 3.8.1 build 328
Description The issue allows remote attackers to upload or download arbitrary files via encoded spaces and double-quote characters in a scp or sftp URI.
Recommendations For WinSCP version 3.8.1 build 328, update to a newer version that contains a fix for this issue to prevent arbitrary file uploads or downloads.

Exploit

Fix

Argument Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2006-3015

Affected Products

Winscp