Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2020-8284

Good to know:

icon

Date: December 14, 2020

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

Language: C

Severity Score

Related Resources (25)

https://www.oracle.com/security-alerts/cpuApr2021.html
https://support.apple.com/kb/HT212325
https://github.com/curl/curl/commit/ec9cc725d598ac
https://www.debian.org/security/2021/dsa-4881
https://people.canonical.com/~ubuntu-security/cve/CVE-2020-8284
https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
https://security-tracker.debian.org/tracker/CVE-2020-8284
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
https://security.gentoo.org/glsa/202012-14
https://support.apple.com/kb/HT212327
https://support.apple.com/kb/HT212326
https://access.redhat.com/security/cve/CVE-2020-8284
https://www.oracle.com/security-alerts/cpujan2022.html
https://nvd.nist.gov/vuln/detail/CVE-2020-8284
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
https://hackerone.com/reports/1040166
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
https://curl.se/docs/CVE-2020-8284.html
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuapr2022.html
https://security.netapp.com/advisory/ntap-20210122-0007/
https://security.alpinelinux.org/vuln/CVE-2020-8284
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
https://www.mend.io/vulnerability-database/CVE-2020-8284

Severity Score

Weakness Type (CWE)

Information Leak / Disclosure

CWE-200

Insufficient Information

NVD-CWE-noinfo

Top Fix

icon

Upgrade Version

Upgrade to version 7.74.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): NONE
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us