2 lines
3.5 KiB
JSON
2 lines
3.5 KiB
JSON
{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:*","matchCriteriaId":"C081564B-8EF8-4C8A-9EB0-1C50D5A8F18B","versionEndExcluding":"5.17.10","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)"},{"lang":"es","value":"WinSCP anterior a la versión 5.17.10 permite a los atacantes remotos ejecutar programas arbitrarios cuando el manejador de URLs encuentra una URL manipulada que carga la configuración de la sesión. (Por ejemplo, esto es explotable en una instalación por defecto en la que WinSCP es el manejador de URLs sftp://)"}],"id":"CVE-2021-3331","lastModified":"2026-10-08T21:17:39.890","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"COMPLETE","baseScore":10.0,"confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","version":"2.0"},"exploitabilityScore":10.0,"impactScore":10.0,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2021-3331","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-08T21:02:17.906285Z","version":"2.0.3"}}]},"published":"2021-01-27T21:15:16.840","references":[{"source":"cve@mitre.org","tags":["Patch","Third Party Advisory"],"url":"https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d"},{"source":"cve@mitre.org","tags":["Release Notes","Vendor Advisory"],"url":"https://winscp.net/eng/docs/history#5.17.10"},{"source":"cve@mitre.org","tags":["Vendor Advisory"],"url":"https://winscp.net/eng/docs/rawsettings"},{"source":"cve@mitre.org","tags":["Patch","Vendor Advisory"],"url":"https://winscp.net/tracker/1943"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"url":"https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"],"url":"https://winscp.net/eng/docs/history#5.17.10"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://winscp.net/eng/docs/rawsettings"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"url":"https://winscp.net/tracker/1943"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]}
|