CVE-2021-3331

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
27/01/2021
Last modified:
04/02/2021

Description

WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:* 5.17.10 (excluding)