Interpretation conflict in WinSCP before 4.0.4 allows remote attackers to perform arbitrary file transfers with a remote server via file-transfer commands in the final portion of a (1) scp, and possibly a (2) sftp or (3) ftp, URL, as demonstrated by a URL specifying login to the remote server with a username of scp, which is interpreted as an HTTP scheme name by the protocol handler in a web browser, but is interpreted as a username by WinSCP. NOTE: this is related to an incomplete fix for CVE-2006-3015.
2007-09-17T17:17:00.000
2025-04-09T00:30:58.490
Deferred
CVSSv2: 9.3 (HIGH)
AV:N/AC:M/Au:N/C:C/I:C/A:C
8.6
10.0
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | winscp | winscp | 2.0.0 | Yes |
| Application | winscp | winscp | 3.5.5_beta | Yes |
| Application | winscp | winscp | 3.5.6 | Yes |
| Application | winscp | winscp | 3.6 | Yes |
| Application | winscp | winscp | 3.6.1 | Yes |
| Application | winscp | winscp | 3.6.5_beta | Yes |
| Application | winscp | winscp | 3.6.6 | Yes |
| Application | winscp | winscp | 3.6.7 | Yes |
| Application | winscp | winscp | 3.8.1 | Yes |
| Application | winscp | winscp | 3.8.2 | Yes |
| Application | winscp | winscp | 4.0.2 | Yes |
| Application | winscp | winscp | 4.0.3 | Yes |