cve/2018/CVE-2018-20684.md

CVE-2018-20684

Description

In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelated files. This affects TSCPFileSystem::SCPSink in core/ScpFileSystem.cpp.

POC

Reference

• https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
• https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
• https://www.oracle.com/security-alerts/cpujan2020.html
• https://www.oracle.com/security-alerts/cpujan2020.html

Github

No PoCs found on GitHub currently.