CVE-2019-14889CWE-78

A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8

High · published December 10, 2019

CVSS v3.0
7.1
EPSS
3%
Percentile
88.0
In the wild
Unconfirmed
What it is

A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target.

The record
Technical detail
CVSS v3.0
7.1 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03174 · 88.0th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2019-12-10T00:00Z
EPSS history
Timeline
  • 10 DEC 00:00Z
    A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8
    cvelistv5