CVE-2020-8284

Published: Dec 14, 2020Modified: Jun 17, 2026

3.7

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.2 / Impact: 1.4

Source: NVD

Description

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

Affected (59)

Products: Haxx: Curl · Fedoraproject: Fedora · Debian: Debian Linux · +6 more

Show all products

1 product

1 product

1 product

5 products

2 products

4 products

Communications Billing And Revenue Management

Communications Cloud Native Core Policy

Essbase

Peoplesoft Enterprise Peopletools

6 products

1 product

Sinec Infrastructure Network Services

Splunk

1 product

Universal Forwarder

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Haxx Curl	Up to 7.73.0

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 32
Fedoraproject Fedora	Version 33

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0

Configuration D

4 vulnerable

Vulnerable Software	Affected Versions
Netapp Clustered Data Ontap	All versions
Netapp Hci Management Node	All versions
Netapp Hci Storage Node	All versions
Netapp Solidfire	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Hci Bootstrap Os	All versions

Running on/with	Platform Versions
Netapp Hci Compute Node	All versions

Configuration F

29 vulnerable

Vulnerable Software	Affected Versions
Apple Mac Os X	From 10.14.0 to 10.14.6
Apple Mac Os X	From 10.15 to 10.15.7
Apple Mac Os X	Version 10.14.6 security_update_2019-001
Apple Mac Os X	Version 10.14.6 security_update_2019-002
Apple Mac Os X	Version 10.14.6 security_update_2019-004
Apple Mac Os X	Version 10.14.6 security_update_2019-005
Apple Mac Os X	Version 10.14.6 security_update_2019-006
Apple Mac Os X	Version 10.14.6 security_update_2019-007
Apple Mac Os X	Version 10.14.6 security_update_2020-001
Apple Mac Os X	Version 10.14.6 security_update_2020-002
Apple Mac Os X	Version 10.14.6 security_update_2020-003
Apple Mac Os X	Version 10.14.6 security_update_2020-004
Apple Mac Os X	Version 10.14.6 security_update_2020-005
Apple Mac Os X	Version 10.14.6 security_update_2020-006
Apple Mac Os X	Version 10.14.6 security_update_2020-007
Apple Mac Os X	Version 10.14.6 security_update_2021-001
Apple Mac Os X	Version 10.14.6 security_update_2021-002
Apple Mac Os X	Version 10.14.6 supplemental_update
Apple Mac Os X	Version 10.14.6 supplemental_update_2
Apple Mac Os X	Version 10.15.7
Apple Mac Os X	Version 10.15.7 security_update_2020-001
Apple Mac Os X	Version 10.15.7 security_update_2020-005
Apple Mac Os X	Version 10.15.7 security_update_2020-007
Apple Mac Os X	Version 10.15.7 security_update_2020
Apple Mac Os X	Version 10.15.7 security_update_2021-001
Apple Mac Os X	Version 10.15.7 supplemental_update
Apple Macos	Version 11.0.1
Apple Macos	Version 11.1
Apple Macos	Version 11.2

Configuration G

4 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Billing And Revenue Management	Version 12.0.0.3.0
Oracle Communications Cloud Native Core Policy	Version 1.14.0
Oracle Essbase	Version 21.2
Oracle Peoplesoft Enterprise Peopletools	Version 8.58

Configuration H

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M10 1 Firmware	Before xcp2410

Configuration I

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M10 4 Firmware	Before xcp2410

Configuration J

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M10 4s Firmware	Before xcp2410

Configuration K

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M12 1 Firmware	Before xcp2410

Configuration L

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M12 2 Firmware	Before xcp2410

Configuration M

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M12 2s Firmware	Before xcp2410

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M10 1 Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M10 1	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M10 4 Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M10 4	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M10 4s Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M10 4s	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M12 1 Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M12 1	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M12 2 Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M12 2	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M12 2s Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M12 2s	All versions

Configuration T

1 vulnerable

Vulnerable Software	Affected Versions
Siemens Sinec Infrastructure Network Services	Before 1.0.1.1

Configuration U

3 vulnerable

Vulnerable Software	Affected Versions
Splunk Universal Forwarder	From 8.2.0 to 8.2.12
Splunk Universal Forwarder	From 9.0.0 to 9.0.6
Splunk Universal Forwarder	Version 9.1.0

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (32)

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Source: support@hackerone.com

PatchThird Party Advisory

https://curl.se/docs/CVE-2020-8284.html

Source: support@hackerone.com

Vendor Advisory

https://hackerone.com/reports/1040166

Source: support@hackerone.com

Permissions Required

https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/202012-14

Source: support@hackerone.com

Third Party Advisory

https://security.netapp.com/advisory/ntap-20210122-0007/

Source: support@hackerone.com

Third Party Advisory

https://support.apple.com/kb/HT212325

Source: support@hackerone.com

Third Party Advisory

https://support.apple.com/kb/HT212326

Source: support@hackerone.com

Third Party Advisory

https://support.apple.com/kb/HT212327

Source: support@hackerone.com

Third Party Advisory

https://www.debian.org/security/2021/dsa-4881

Source: support@hackerone.com

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: support@hackerone.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: support@hackerone.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: support@hackerone.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: support@hackerone.com

PatchThird Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf