CVE-2020-8284
https://github.com/curl/curl
LOW 3.7
At a glance
- Source
- NVD
- EPSS
- EPSS 3.90 % · percentile 90 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- hackerone
- NVD status
- Modified
Description
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
Weaknesses (CWE)
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
References
- https://hackerone.com/reports/1040166
- https://curl.se/docs/CVE-2020-8284.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
- https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
- https://security.gentoo.org/glsa/202012-14
- https://www.debian.org/security/2021/dsa-4881
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://security.netapp.com/advisory/ntap-20210122-0007/
- https://support.apple.com/kb/HT212325
- https://support.apple.com/kb/HT212326
- https://support.apple.com/kb/HT212327
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://cert-portal.siemens.com/productcert/html/ssa-389290.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | LOW 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
| CVSS 3.1 | LOW 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | LOW 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2020-29152
- GCVE · GCVE-0-2020-8284
CERT-FR advisories
- CERTFR-2026-AVI-0199 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0297 — Multiples vulnérabilités dans Juniper · cert.ssi.gouv.fr
- CERTFR-2023-AVI-1015 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0701 — Multiples vulnérabilités dans Splunk · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0428 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
- CERTFR-2022-AVI-216 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2021-AVI-791 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2021-AVI-555 — Multiples vulnérabilités dans Juniper Junos OS · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*≤ 7.73.0cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:hci_bootstrap_os:-:*:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*≥ 10.14.0 < 10.14.6cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*≥ 10.15 < 10.15.7cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-004:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-005:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-006:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-007:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-001:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-002:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update_2:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-005:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-007:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.15.7:supplemental_update:*:*:*:*:*:*cpe:2.3:o:apple:macos:11.0.1:*:*:*:*:*:*:*cpe:2.3:o:apple:macos:11.1:*:*:*:*:*:*:*cpe:2.3:o:apple:macos:11.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*- +19 more
Affected products
| Product | Versions |
|---|---|
| https://github.com/curl/curl | affected 7.73.0 and earlier |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |