Lucene search

MitreCVE-2018-20685

HistoryJan 10, 2019 - 9:29 p.m.

CVE-2018-20685

2019-01-1021:29:00

CWE-863

mitre

web.nvd.nist.gov

4738

In Wild

openssh

scp

access restrictions

cve-2018-20685

nvd

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

6.3

Confidence

High

EPSS

0.004

Percentile

73.2%

JSON

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.

Affected configurations

Nvd

Node

openbsdopensshRange≤7.9

winscpwinscpRange≤5.13

Node

netappcloud_backupMatch-

netappelement_softwareMatch-

netappontap_select_deployMatch-

netappsteelstore_cloud_integrated_storageMatch-

netappstorage_automation_storeMatch-

Node

debiandebian_linuxMatch8.0

debiandebian_linuxMatch9.0

Node

canonicalubuntu_linuxMatch14.04lts

canonicalubuntu_linuxMatch16.04lts

canonicalubuntu_linuxMatch18.04lts

canonicalubuntu_linuxMatch18.10

Node

redhatenterprise_linuxMatch7.0

redhatenterprise_linuxMatch8.0

redhatenterprise_linux_eusMatch8.1

redhatenterprise_linux_eusMatch8.2

redhatenterprise_linux_eusMatch8.4

redhatenterprise_linux_eusMatch8.6

redhatenterprise_linux_server_ausMatch8.2

redhatenterprise_linux_server_ausMatch8.4

redhatenterprise_linux_server_ausMatch8.6

redhatenterprise_linux_server_tusMatch8.2

redhatenterprise_linux_server_tusMatch8.4

redhatenterprise_linux_server_tusMatch8.6

Node

oraclesolarisMatch10

Node

fujitsum10-1Match-

AND

fujitsum10-1_firmwareRange<xcp2361

Node

fujitsum10-4Match-

AND

fujitsum10-4_firmwareRange<xcp2361

Node

fujitsum10-4sMatch-

AND

fujitsum10-4s_firmwareRange<xcp2361

Node

fujitsum12-1Match-

AND

fujitsum12-1_firmwareRange<xcp2361

Node

fujitsum12-2Match-

AND

fujitsum12-2_firmwareRange<xcp2361

Node

fujitsum12-2sMatch-

AND

fujitsum12-2s_firmwareRange<xcp2361

Node

fujitsum10-1Match-

AND

fujitsum10-1_firmwareRange<xcp3070

Node

fujitsum10-4Match-

AND

fujitsum10-4_firmwareRange<xcp3070

Node

fujitsum10-4sMatch-

AND

fujitsum10-4s_firmwareRange<xcp3070

Node

fujitsum10-4sMatch-

AND

fujitsum10-4s_firmwareRange<xcp3070

Node

fujitsum12-1Match-

AND

fujitsum12-1_firmwareRange<xcp3070

Node

fujitsum12-2_firmwareRange<xcp3070

AND

fujitsum12-2Match-

Node

fujitsum12-2s_firmwareRange<xcp3070

AND

fujitsum12-2sMatch-

Node

siemensscalance_x204rna_firmwareRange<3.2.7

AND

siemensscalance_x204rnaMatch-

Node

siemensscalance_x204rna_eec_firmwareRange<3.2.7

AND

siemensscalance_x204rna_eecMatch-

VendorProductVersionCPE
openbsdopenssh*cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
winscpwinscp*cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:*
netappcloud_backup-cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
netappelement_software-cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*
netappontap_select_deploy-cpe:2.3:a:netapp:ontap_select_deploy:-:*:*:*:*:*:*:*
netappsteelstore_cloud_integrated_storage-cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
netappstorage_automation_store-cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*
debiandebian_linux8.0cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
debiandebian_linux9.0cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
canonicalubuntu_linux14.04cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

Vendor	Product	Version	CPE
openbsd	openssh	*	cpe:2.3:a:openbsd:openssh::::::::
winscp	winscp	*	cpe:2.3:a:winscp:winscp::::::::
netapp	cloud_backup	-	cpe:2.3:a:netapp:cloud_backup:-:::::::*
netapp	element_software	-	cpe:2.3:a:netapp:element_software:-:::::::*
netapp	ontap_select_deploy	-	cpe:2.3:a:netapp:ontap_select_deploy:-:::::::*
netapp	steelstore_cloud_integrated_storage	-	cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:::::::*
netapp	storage_automation_store	-	cpe:2.3:a:netapp:storage_automation_store:-:::::::*
debian	debian_linux	8.0	cpe:2.3:o:debian:debian_linux:8.0:::::::*
debian	debian_linux	9.0	cpe:2.3:o:debian:debian_linux:9.0:::::::*
canonical	ubuntu_linux	14.04	cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::