CVE-2020-8284

LOWMonitor

Published:Dec 14, 2020(5 years ago)

Modified:Nov 21, 2024

Remote ExploitNo Auth RequiredNo Interaction

Vulnerability Description

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

Attack Characteristics

Network AccessHigh ComplexityNo Auth NeededNo User Interaction

🤖

AI analysis not yet available

Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.

No Fix Known

No patch has been released yet. Apply workarounds or mitigations where available.

Affected Software

Vendor	Product	Versions	Fixed In
haxx	curl	7.73.0	-
fedoraproject	fedora	-	-
fedoraproject	fedora	-

Timeline

Published
CVE disclosed publicly
Dec 14, 20205 years ago
Last Modified
Most recent update
Nov 21, 20241 year ago
Indexed to CVEInsight
Added to this platform
Mar 29, 20261 month ago

References

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatch
https://curl.se/docs/CVE-2020-8284.htmlVendor Advisory
https://hackerone.com/reports/1040166Permissions Required

CVSS Score

v3.1

3.7/ 10.0

LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

At a Glance

Affected Products

References

haxx / curl +58 more

https://lists.debian.org/debian-lts-announce/2020/12/msg00029.htmlMailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists...Mailing List

https://security.gentoo.org/glsa/202012-14Third Party Advisory

https://security.netapp.com/advisory/ntap-20210122-0007/Third Party Advisory

https://support.apple.com/kb/HT212325Third Party Advisory

https://support.apple.com/kb/HT212326Third Party Advisory

https://support.apple.com/kb/HT212327Third Party Advisory

https://www.debian.org/security/2021/dsa-4881Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.htmlPatch

https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch

https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch

https://www.oracle.com/security-alerts/cpujan2022.htmlPatch

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatch

https://curl.se/docs/CVE-2020-8284.htmlVendor Advisory

https://hackerone.com/reports/1040166Permissions Required

https://lists.debian.org/debian-lts-announce/2020/12/msg00029.htmlMailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists...Mailing List

https://security.gentoo.org/glsa/202012-14Third Party Advisory

https://security.netapp.com/advisory/ntap-20210122-0007/Third Party Advisory

https://support.apple.com/kb/HT212325Third Party Advisory

https://support.apple.com/kb/HT212326Third Party Advisory

https://support.apple.com/kb/HT212327Third Party Advisory

https://www.debian.org/security/2021/dsa-4881Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.htmlPatch

https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch

https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch

https://www.oracle.com/security-alerts/cpujan2022.htmlPatch

CVSS v3 Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability

Attack VectorNetwork

Attack ComplexityHigh

Privileges RequiredNone

User InteractionNone

Impact

ScopeUnchanged

ConfidentialityLow

IntegrityNone

AvailabilityNone

Impact Analysis

ConfidentialityLow

NoneLowHigh

IntegrityNone

NoneLowHigh

AvailabilityNone

NoneLowHigh

CVE-2020-8284

✦ Vulnerability Description

Attack Characteristics

Affected Software

Timeline

References

CVSS Score

At a Glance

Official Sources

CVSS v3 Vector

Impact Analysis

Vulnerability Description