{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)"}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-01-27T20:22:25.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://winscp.net/eng/docs/history#5.17.10"}, {"tags": ["x_refsource_MISC"], "url": "https://winscp.net/tracker/1943"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d"}, {"tags": ["x_refsource_MISC"], "url": "https://winscp.net/eng/docs/rawsettings"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2021-3331", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://winscp.net/eng/docs/history#5.17.10", "refsource": "MISC", "url": "https://winscp.net/eng/docs/history#5.17.10"}, {"name": "https://winscp.net/tracker/1943", "refsource": "MISC", "url": "https://winscp.net/tracker/1943"}, {"name": "https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d", "refsource": "MISC", "url": "https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d"}, {"name": "https://winscp.net/eng/docs/rawsettings", "refsource": "MISC", "url": "https://winscp.net/eng/docs/rawsettings"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T16:53:17.236Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://winscp.net/eng/docs/history#5.17.10"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://winscp.net/tracker/1943"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://winscp.net/eng/docs/rawsettings"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-3331", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-08T21:02:17.906285Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T21:03:32.228Z"}}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2021-3331", "datePublished": "2021-01-27T20:22:25.000Z", "dateReserved": "2021-01-27T00:00:00.000Z", "dateUpdated": "2026-10-08T21:03:32.228Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.2"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "[email protected]"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:*", "matchCriteriaId": "C081564B-8EF8-4C8A-9EB0-1C50D5A8F18B", "versionEndExcluding": "5.17.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)"}, {"lang": "es", "value": "WinSCP anterior a la versi\u00f3n 5.17.10 permite a los atacantes remotos ejecutar programas arbitrarios cuando el manejador de URLs encuentra una URL manipulada que carga la configuraci\u00f3n de la sesi\u00f3n. (Por ejemplo, esto es explotable en una instalaci\u00f3n por defecto en la que WinSCP es el manejador de URLs sftp://)"}], "id": "CVE-2021-3331", "lastModified": "2026-10-08T21:17:39.890", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-3331", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-08T21:02:17.906285Z", "version": "2.0.3"}}]}, "published": "2021-01-27T21:15:16.840", "references": [{"source": "[email protected]", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d"}, {"source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://winscp.net/eng/docs/history#5.17.10"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://winscp.net/eng/docs/rawsettings"}, {"source": "[email protected]", "tags": ["Patch", "Vendor Advisory"], "url": "https://winscp.net/tracker/1943"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://winscp.net/eng/docs/history#5.17.10"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://winscp.net/eng/docs/rawsettings"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://winscp.net/tracker/1943"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "[email protected]", "type": "Primary"}]}

{}