CVE-2021-3331

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)"}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-01-27T20:22:25.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://winscp.net/eng/docs/history#5.17.10"}, {"tags": ["x_refsource_MISC"], "url": "https://winscp.net/tracker/1943"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d"}, {"tags": ["x_refsource_MISC"], "url": "https://winscp.net/eng/docs/rawsettings"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2021-3331", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://winscp.net/eng/docs/history#5.17.10", "refsource": "MISC", "url": "https://winscp.net/eng/docs/history#5.17.10"}, {"name": "https://winscp.net/tracker/1943", "refsource": "MISC", "url": "https://winscp.net/tracker/1943"}, {"name": "https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d", "refsource": "MISC", "url": "https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d"}, {"name": "https://winscp.net/eng/docs/rawsettings", "refsource": "MISC", "url": "https://winscp.net/eng/docs/rawsettings"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T16:53:17.236Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://winscp.net/eng/docs/history#5.17.10"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://winscp.net/tracker/1943"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://winscp.net/eng/docs/rawsettings"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-3331", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-08T21:02:17.906285Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T21:03:32.228Z"}}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2021-3331", "datePublished": "2021-01-27T20:22:25.000Z", "dateReserved": "2021-01-27T00:00:00.000Z", "dateUpdated": "2026-10-08T21:03:32.228Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://winscp.net/eng/docs/history#5.17.10", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://winscp.net/tracker/1943", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://winscp.net/eng/docs/rawsettings", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T16:53:17.236Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-3331", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-08T21:02:17.906285Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T21:02:18.599Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://winscp.net/eng/docs/history#5.17.10", "tags": ["x_refsource_MISC"]}, {"url": "https://winscp.net/tracker/1943", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d", "tags": ["x_refsource_MISC"]}, {"url": "https://winscp.net/eng/docs/rawsettings", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2021-01-27T20:22:25.000Z"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "n/a"}]}, "product_name": "n/a"}]}, "vendor_name": "n/a"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://winscp.net/eng/docs/history#5.17.10", "name": "https://winscp.net/eng/docs/history#5.17.10", "refsource": "MISC"}, {"url": "https://winscp.net/tracker/1943", "name": "https://winscp.net/tracker/1943", "refsource": "MISC"}, {"url": "https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d", "name": "https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d", "refsource": "MISC"}, {"url": "https://winscp.net/eng/docs/rawsettings", "name": "https://winscp.net/eng/docs/rawsettings", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2021-3331", "STATE": "PUBLIC", "ASSIGNER": "cve@mitre.org"}}}}, "cveMetadata": {"cveId": "CVE-2021-3331", "state": "PUBLISHED", "dateUpdated": "2026-10-08T21:03:32.228Z", "dateReserved": "2021-01-27T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2021-01-27T20:22:25.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:*", "matchCriteriaId": "C081564B-8EF8-4C8A-9EB0-1C50D5A8F18B", "versionEndExcluding": "5.17.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)"}, {"lang": "es", "value": "WinSCP anterior a la versi\u00f3n 5.17.10 permite a los atacantes remotos ejecutar programas arbitrarios cuando el manejador de URLs encuentra una URL manipulada que carga la configuraci\u00f3n de la sesi\u00f3n. (Por ejemplo, esto es explotable en una instalaci\u00f3n por defecto en la que WinSCP es el manejador de URLs sftp://)"}], "id": "CVE-2021-3331", "lastModified": "2026-10-08T21:17:39.890", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-3331", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-08T21:02:17.906285Z", "version": "2.0.3"}}]}, "published": "2021-01-27T21:15:16.840", "references": [{"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://winscp.net/eng/docs/history#5.17.10"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://winscp.net/eng/docs/rawsettings"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://winscp.net/tracker/1943"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://winscp.net/eng/docs/history#5.17.10"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://winscp.net/eng/docs/rawsettings"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://winscp.net/tracker/1943"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}