CVE-2021-3331

2021-01-27T21:15:00
ID CVE-2021-3331
Type cve
Reporter cve@mitre.org
Modified 2021-02-04T15:59:00

Description

WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)