CVE-2019-6111
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
- CVSS 3.1
- 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - EPSS
- 58% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-25)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:mina_sshd
- canonical:ubuntu_linux
- debian:debian_linux
- fedoraproject:fedora
- freebsd:freebsd
- fujitsu:m10-1_firmware
- fujitsu:m10-4_firmware
- fujitsu:m10-4s_firmware
- fujitsu:m12-1_firmware
- fujitsu:m12-2_firmware
- fujitsu:m12-2s_firmware
- openbsd:openssh
- redhat:enterprise_linux
- redhat:enterprise_linux_eus
- redhat:enterprise_linux_server_aus
- redhat:enterprise_linux_server_tus
- siemens:scalance_x204rna_eec_firmware
- siemens:scalance_x204rna_firmware
- winscp:winscp