CVE-2007-4909

Status: ModifiedHigh (9.3)—Exploit

Severity9.3High · CVSS 2.0

Exploitation probability3.52 %higher than 89% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitAvailablePublished on Exploit-DB

Interpretation conflict in WinSCP before 4.0.4 allows remote attackers to perform arbitrary file transfers with a remote server via file-transfer commands in the final portion of a (1) scp, and possibly a (2) sftp or (3) ftp, URL, as demonstrated by a URL specifying login to the remote server with a username of scp, which is interpreted as an HTTP scheme name by the protocol handler in a web browser, but is interpreted as a username by WinSCP. NOTE: this is related to an incomplete fix for CVE-2006-3015.

CVSS

Base score: 9.3
Version: 2.0
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 3.52 %
Percentile among all scored CVEs: 89
Score date: 10/24/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Published on Exploit-DB · WinSCP 4.0.3 - URL Protocol Handler Arbitrary File Access (9/13/2007)

Affected technologies (1)

Winscp — Winscp

CWEs

CWE-264

References

Show 16 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2007-4909",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-09-17T17:17:00.000",
  "references": [
    {
      "url": "http://secunia.com/advisories/26820",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/3141",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://winscp.cvs.sourceforge.net/winscp/winscp3/core/SessionData.cpp?r1=1.29&r2=1.30",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://winscp.net/eng/docs/history/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/479298/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/25655",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id?1018697",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36591",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/26820",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/3141",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://winscp.cvs.sourceforge.net/winscp/winscp3/core/SessionData.cpp?r1=1.29&r2=1.30",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://winscp.net/eng/docs/history/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/479298/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/25655",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1018697",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36591",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Interpretation conflict in WinSCP before 4.0.4 allows remote attackers to perform arbitrary file transfers with a remote server via file-transfer commands in the final portion of a (1) scp, and possibly a (2) sftp or (3) ftp, URL, as demonstrated by a URL specifying login to the remote server with a username of scp, which is interpreted as an HTTP scheme name by the protocol handler in a web browser, but is interpreted as a username by WinSCP.  NOTE: this is related to an incomplete fix for CVE-2006-3015."
    },
    {
      "lang": "es",
      "value": "Conflicto de interpretación en WinSCP anterior a 4.0.4 permite a atacantes remotos llevar a cabo transferencias de archvios de su elección con un servidor remoto a través de comandos de transferencia de archivos en la porción final de un (1) scp, y posiblemente un (2)sftp o (3) ftp, URL, tal y como se demostró con la validación de una URL específica en un servidor remoto con un nombre de usuario de scp, el cual es interpretado como un nombre de esquema HTTP a través del manejador de protocolo del navegador web, pero este es interpretado como un nombre de usuario por WinSCP. NOTA: esto está relacionado con un parche incompleto para CVE-2006-3015."
    }
  ],
  "lastModified": "2026-06-16T22:44:59.373",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:winscp:winscp:2.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "833B5B6D-9A6B-4F25-81B0-F27D82940F8D"
            },
            {
              "criteria": "cpe:2.3:a:winscp:winscp:3.5.5_beta:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1441C593-8BA8-4D10-BE13-4D4D01B5ACB9"
            },
            {
              "criteria": "cpe:2.3:a:winscp:winscp:3.5.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FEE92BE-F80D-481E-95DF-2C33E8DE3D3B"
            },
            {
              "criteria": "cpe:2.3:a:winscp:winscp:3.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "61A75DF1-1A3E-4898-B7A6-750F9FA8D1A6"
            },
            {
              "criteria": "cpe:2.3:a:winscp:winscp:3.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79C692ED-9C28-4CAA-B72A-4CCC78AE8680"
            },
            {
              "criteria": "cpe:2.3:a:winscp:winscp:3.6.5_beta:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D214F458-12B5-4280-AF10-33426933992E"
            },
            {
              "criteria": "cpe:2.3:a:winscp:winscp:3.6.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD7FE4B2-2433-4B7F-BFA2-DCDEC32F329E"
            },
            {
              "criteria": "cpe:2.3:a:winscp:winscp:3.6.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B57BACA5-6820-48BB-906F-6AA010429F18"
            },
            {
              "criteria": "cpe:2.3:a:winscp:winscp:3.8.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA9F9BEF-14B6-429B-915F-45958C568F76"
            },
            {
              "criteria": "cpe:2.3:a:winscp:winscp:3.8.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89254511-B715-4515-AA6F-86133A2182CD"
            },
            {
              "criteria": "cpe:2.3:a:winscp:winscp:4.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FDD786A3-A146-4E4B-90C4-D9F8A2E7D986"
            },
            {
              "criteria": "cpe:2.3:a:winscp:winscp:4.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "200669EB-F6A1-4C6F-9939-EB3ADB472161"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}