⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.

CVE-2018-20685 — Incorrect Authorization in Openssh

CWE-863 — Incorrect AuthorizationCWE-20 — Improper Input ValidationCWE-281 — Improper Preservation of Permissions12 documents9 sources
Severity
5.3MEDIUMNVD
EPSS
3.4%
top 12.60%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
17
Openbsd OpensshFujitsu M10-1 FirmwareFujitsu M10-4 Firmware+14 more
Timeline
PublishedJan 10
Latest updateMay 13

Description

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages12 packages

▶Debianopenbsd/openssh< 1:7.9p1-5+3
▶NVDfujitsu/m10-1_firmware< xcp2361+1
▶NVDfujitsu/m10-4_firmware< xcp2361+1
▶NVDfujitsu/m12-1_firmware< xcp2361+1

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 14.04, 16.04, 18.04, 18.10, Enterprise Linux 7.0, 8.0, 8.1, 8.2, 8.4, 8.6

Patches

Patch: cert-portal.siemens.com ↗Patch: cvsweb.openbsd.org ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-28hp-2gv6-gjp8: In OpenSSH 7↗2022-05-13
▶
OSV
CVE-2018-20685: In OpenSSH 7↗2019-01-10
▶
CVEList
CVE-2018-20685: In OpenSSH 7↗2019-01-10
▶
VulnCheck
OpenBSD openssh Incorrect Authorization↗2018
▶

📋Vendor Advisories

5
Red Hat
netkit-rsh: rcp access restriction bypass↗2021-11-19
▶
Red Hat
krb5-appl: Improper directory name validation allows malicious server to bypass access restrictions↗2021-02-02
▶
Ubuntu
OpenSSH vulnerabilities↗2019-02-07
▶
Red Hat
openssh: scp client improper directory name validation↗2018-11-16
▶
Debian
CVE-2018-20685: openssh - In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass inte...↗2018
▶

💬Community

2
Bugzilla
CVE-2018-20685 openssh: scp client improper directory name validation↗2019-01-14
▶
Bugzilla
CVE-2018-20685 openssh: scp client improper directory name validation [fedora-all]↗2019-01-14
▶
CVE-2018-20685 — Incorrect Authorization in Openssh | cvebase