KLA73523 OSI vulnerability in WinSCP

2024-04-1600:00:00

Kaspersky Lab

threats.kaspersky.com

winscp

vulnerability

information disclosure

exploit

security bypass

update

affected products

osi

cve-2024-31497

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

Confidence

Low

JSON

Information disclosure vulnerability was found in WinSCP. Malicious users can exploit this vulnerability to obtain sensitive information, bypass security restrictions.

Original advisories

Changes in WinSCP 6.3.3

Exploitation

Public exploits exist for this vulnerability.

Related products

WinSCP

CVE list

CVE-2024-31497 high

Solution

Update to the latest version

Download WinSCP

Impacts

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.