Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
WinSCP before 5.5.3, when FTP with TLS is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
WinSCP 输入验证漏洞
Vulnerability Description
WinSCP是捷克布拉格经济大学所开发与维护的一套在Windows环境下使用SSH的开源图形化SFTP和FTP客户端。该客户端支持SCP、SSH等协议，其主要功能是在本地与远程计算机间安全地复制文件，并且可以直接编辑文件。 WinSCP 5.5.2及之前的版本中存在安全漏洞，该漏洞源于当使用带有TLS的FTP时，程序没有验证X.509证书的服务器主机名和域名是否匹配。攻击者可借助任意有效的证书利用该漏洞实施中间人攻击，欺骗SSL服务器。
CVSS Information
N/A
Vulnerability Type
N/A