Lucene search

HackeroneCVE-2020-8284

HistoryDec 14, 2020 - 8:15 p.m.

CVE-2020-8284

2020-12-1420:15:13

CWE-200

hackerone

web.nvd.nist.gov

283

cve-2020-8284

security vulnerability

curl 7.73.0

ftp pasv response

port scanning

service banner extraction

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

45.3%

JSON

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

Affected configurations

Nvd

Vulners

Node

haxxcurlRange≤7.73.0

Node

fedoraprojectfedoraMatch32

fedoraprojectfedoraMatch33

Node

debiandebian_linuxMatch9.0

debiandebian_linuxMatch10.0

Node

netappclustered_data_ontapMatch-

netapphci_management_nodeMatch-

netappsolidfireMatch-

netapphci_storage_nodeMatch-

Node

netapphci_bootstrap_osMatch-

AND

netapphci_compute_nodeMatch-

Node

applemac_os_xRange10.14.0–10.14.6

applemac_os_xRange10.15–10.15.7

applemac_os_xMatch10.14.6security_update_2019-001

applemac_os_xMatch10.14.6security_update_2019-002

applemac_os_xMatch10.14.6security_update_2019-004

applemac_os_xMatch10.14.6security_update_2019-005

applemac_os_xMatch10.14.6security_update_2019-006

applemac_os_xMatch10.14.6security_update_2019-007

applemac_os_xMatch10.14.6security_update_2020-001

applemac_os_xMatch10.14.6security_update_2020-002

applemac_os_xMatch10.14.6security_update_2020-003

applemac_os_xMatch10.14.6security_update_2020-004

applemac_os_xMatch10.14.6security_update_2020-005

applemac_os_xMatch10.14.6security_update_2020-006

applemac_os_xMatch10.14.6security_update_2020-007

applemac_os_xMatch10.14.6security_update_2021-001

applemac_os_xMatch10.14.6security_update_2021-002

applemac_os_xMatch10.14.6supplemental_update

applemac_os_xMatch10.14.6supplemental_update_2

applemac_os_xMatch10.15.7-

applemac_os_xMatch10.15.7security_update_2020

applemac_os_xMatch10.15.7security_update_2020-001

applemac_os_xMatch10.15.7security_update_2020-005

applemac_os_xMatch10.15.7security_update_2020-007

applemac_os_xMatch10.15.7security_update_2021-001

applemac_os_xMatch10.15.7supplemental_update

applemacosMatch11.0.1

applemacosMatch11.1

applemacosMatch11.2

Node

oraclecommunications_billing_and_revenue_managementMatch12.0.0.3.0

oraclecommunications_cloud_native_core_policyMatch1.14.0

oracleessbaseMatch21.2

oraclepeoplesoft_enterprise_peopletoolsMatch8.58

Node

fujitsum10-1_firmwareRange<xcp2410

AND

fujitsum10-1Match-

Node

fujitsum10-4Match-

AND

fujitsum10-4_firmwareRange<xcp2410

Node

fujitsum10-4sMatch-

AND

fujitsum10-4s_firmwareRange<xcp2410

Node

fujitsum12-1Match-

AND

fujitsum12-1_firmwareRange<xcp2410

Node

fujitsum12-2Match-

AND

fujitsum12-2_firmwareRange<xcp2410

Node

fujitsum12-2sMatch-

AND

fujitsum12-2s_firmwareRange<xcp2410

Node

fujitsum10-1Match-

AND

fujitsum10-1_firmwareRange<xcp3110

Node

fujitsum10-4Match-

AND

fujitsum10-4_firmwareRange<xcp3110

Node

fujitsum10-4s_firmwareRange<xcp3110

AND

fujitsum10-4sMatch-

Node

fujitsum12-1_firmwareRange<xcp3110

AND

fujitsum12-1Match-

Node

fujitsum12-2_firmwareRange<xcp3110

AND

fujitsum12-2Match-

Node

fujitsum12-2s_firmwareRange<xcp3110

AND

fujitsum12-2sMatch-

Node

siemenssinec_infrastructure_network_servicesRange<1.0.1.1

Node

splunkuniversal_forwarderRange8.2.0–8.2.12

splunkuniversal_forwarderRange9.0.0–9.0.6

splunkuniversal_forwarderMatch9.1.0

VendorProductVersionCPE
haxxcurlcpe:/a:haxx:curl::::

Vendor	Product	Version	CPE
haxx	curl		cpe:/a:haxx:curl::::

CNA Affected

[
  {
    "product": "https://github.com/curl/curl",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "7.73.0 and earlier"
      }
    ]
  }
]