CVE-2021-3331
Critical
Description
WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)
SeverityCritical
CVSS9.8
Exploit probability—
ProductWinscp
PublishedJan 27, 2021
First seenJan 27, 2021
How to fix
Update
- winscp winscp5.17.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| winscp winscp | v < 5.17.10 | 5.17.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.