⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.
CVE-2019-6111 — Path Traversal in Openssh
Severity
5.9MEDIUMNVD
EPSS
54.4%
top 1.97%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedJan 31
Latest updateFeb 10
Description
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirecto…
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 2.2 | Impact: 3.6
Affected Packages15 packages
Also affects: Debian Linux 8.0, 9.0, Fedora 30, Ubuntu Linux 14.04, 16.04, 18.04, 18.10, Enterprise Linux 7.0, 8.0, 8.1, 8.2, 8.4, 8.6
Patches
🔴Vulnerability Details
5VulnCheck
▶
💥Exploits & PoCs
2📋Vendor Advisories
8Palo Alto
▶
Red Hat▶
krb5-appl: Improper validation of object names allows malicious server to overwrite files via rcp client↗2021-02-02