scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

🗓️ 25 Sep 2020 07:00:00Reported by MicrosoftType

OpenSSH secure copy protocol up to 8.3p1 allows command injection via backticks in the destination argument.

Reporter	Title	Published	Views	Family All 161
GithubExploit	Exploit for OS Command Injection in Openbsd Openssh	18 Jul 202005:15	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Openbsd Openssh	15 Jul 202101:04	–	githubexploit
GithubExploit	Exploit for Path Traversal in Openbsd Openssh	18 Jan 202602:13	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Openbsd Openssh	15 Jul 202101:04	–	githubexploit
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been identified with the DS8900F and DS8A00 Hardware Management Console (HMC)	27 May 202523:25	–	ibm
IBM Security Bulletins	Security Bulletin: OpenSSH vulnerability affects IBM Spectrum Protect Plus (CVE-2020-15778)	3 Aug 202022:40	–	ibm
IBM Security Bulletins	Security Bulletin: TSSC/IMC addresses multiple security vulnerabilities.	22 May 202521:25	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in OpenSSH affects IBM Integrated Analytics System (Sailfish) [CVE-2023-51385, CVE-2023-48795, CVE-2023-38408, CVE-2020-15778, CVE-2021-41617].	20 May 202509:21	–	ibm
IBM Security Bulletins	Security Bulletin: Publicly disclosed vulnerability from OpenSSH affects IBM Netezza Host Management	27 Sep 202017:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium Insights is affected by multiple vulnerabilities	12 Jan 202120:04	–	ibm

Vulners

Node

25 Sep 2020 07:00Current

7High risk

Vulners AI Score7

CVSS 26.8

CVSS 3.17.4 - 7.8

EPSS0.12996

SSVC