Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2020-8284

UNKNOWN
Published 2020-12-14T19:38:26
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2020-8284. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

⚠ Unreviewed MODERATE

GHSA-69rc-qfx4-h683

Advisory Details

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

CVSS Scoring

CVSS Score

5.0

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2020-8284
WEB https://hackerone.com/reports/1040166
WEB https://www.oracle.com/security-alerts/cpujan2022.html
WEB https://www.oracle.com/security-alerts/cpuapr2022.html
WEB https://www.oracle.com/security-alerts/cpuApr2021.html
WEB https://www.oracle.com//security-alerts/cpujul2021.html
WEB https://www.debian.org/security/2021/dsa-4881
WEB https://support.apple.com/kb/HT212327
WEB https://support.apple.com/kb/HT212326
WEB https://support.apple.com/kb/HT212325
WEB https://security.netapp.com/advisory/ntap-20210122-0007
WEB https://security.gentoo.org/glsa/202012-14
WEB https://lists.fedoraproject.org/archives/list/[email protected]/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG
WEB https://lists.fedoraproject.org/archives/list/[email protected]/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL
WEB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG
WEB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL
WEB https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
WEB https://curl.se/docs/CVE-2020-8284.html
WEB https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Advisory provided by GitHub Security Advisory Database. Published: May 24, 2022, Modified: March 27, 2024

References

https://hackerone.com/reports/1040166
https://curl.se/docs/CVE-2020-8284.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
https://security.gentoo.org/glsa/202012-14
https://www.debian.org/security/2021/dsa-4881
https://www.oracle.com/security-alerts/cpuApr2021.html
https://security.netapp.com/advisory/ntap-20210122-0007/
https://support.apple.com/kb/HT212325
https://support.apple.com/kb/HT212326
https://support.apple.com/kb/HT212327
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.oracle.com/security-alerts/cpuapr2022.html
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

HackerOne Reports

lib/net/ftp.rb: trusting PASV responses allow client abuse Low
sighook
Ruby
$500.00
Information Disclosure
View Report
[High] Arbitrary File Write via Path Traversal in cURL CLI (`-o`, `--output`) (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) High
oicus
curl
Path Traversal
View Report
Published: 2020-12-14T19:38:26
Last Modified: 2024-08-04T09:56:28.316Z
Copied to clipboard!