Vulnerability in Winscp

CVE-2006-3015

Argument injection vulnerability in WinSCP 3.8.1 build 328 allows remote attackers to upload or download arbitrary files via encoded spaces and double-quote characters in a scp or sftp URI.

EPSS: 0.065 (93.0th percentile) — read the EPSS interpretation.

Affected products

  • Winscp — versions 3.8.1
  • N/a — versions n/a

Weakness classification (CWE)

Public proof-of-concept exploits

References

  • cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_XF)
  • cve@mitre.org (x_refsource_CONFIRM, Release Notes)
  • cve@mitre.org (mailing-list, Exploit, x_refsource_FULLDISC, Broken Link)
  • cve@mitre.org (mailing-list, x_refsource_FULLDISC, Broken Link)
  • cve@mitre.org (x_refsource_SECUNIA, Broken Link, Vendor Advisory, third-party-advisory)
  • cve@mitre.org (vdb-entry, Broken Link, x_refsource_VUPEN)
  • cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)
  • cve@mitre.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2006-3015?
CVE-2006-3015 is a vulnerability in Winscp, classified under Argument Injection. Published 2006-06-14.
Is CVE-2006-3015 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.