CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NCVE-2017-15906
The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.
Severity
- EPSS
- 3.4% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
- CWE
- CWE-732
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- netapp:active_iq_unified_manager
- netapp:cloud_backup
- netapp:clustered_data_ontap
- netapp:cn1610_firmware
- netapp:data_ontap_edge
- netapp:hci_management_node
- netapp:oncommand_unified_manager_core_package
- netapp:solidfire
- netapp:steelstore_cloud_integrated_storage
- netapp:storage_replication_adapter_for_clustered_data_ontap
- netapp:vasa_provider_for_clustered_data_ontap
- netapp:virtual_storage_console
- openbsd:openssh
- oracle:sun_zfs_storage_appliance_kit
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_eus
- redhat:enterprise_linux_server
- redhat:enterprise_linux_server_aus
- redhat:enterprise_linux_server_tus
- redhat:enterprise_linux_workstation