CVE-2020-8284
- State
- Published
- Severity
- 3.7 Low
- Published
- Dec 14, 2020
- Updated
- Oct 14, 2026
- Reserved
- Jan 28, 2020
Description
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.7 Low | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-200 Information Disclosure (CWE-200)
Affected Products
| Product | Versions |
|---|---|
https://github.com/curl/curln/a |
|
References
- https://hackerone.com/reports/1040166
- https://curl.se/docs/CVE-2020-8284.html
- FEDORA-2020-ceaf490686vendor-advisory
- [debian-lts-announce] 20201219 [SECURITY] [DLA 2500-1] curl security updatemailing-list
- FEDORA-2020-7ab62c73bcvendor-advisory
- GLSA-202012-14vendor-advisory
- DSA-4881vendor-advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://security.netapp.com/advisory/ntap-20210122-0007/
- https://support.apple.com/kb/HT212325
- https://support.apple.com/kb/HT212326
- https://support.apple.com/kb/HT212327
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://cert-portal.siemens.com/productcert/html/ssa-389290.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.