CVE-2020-8284Proof of concept (PoC) published · CISA

Information exposure in N/a Https://github.com/curl/curl

CVSS score

3.7

EPSS probability

%3.9

Risk score

0.1

Published

5 y ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Official patch verified

Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2020-8284 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2020-8284 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

ID	VENDOR	PRODUCT	ACTION
1	n/a	https://github.com/curl/curl	View
2	haxx	curl	View
3	fedoraproject	fedora	View
4	fedoraproject	fedora	View
5	debian	debian linux	View
6	debian	debian linux	View
7	netapp	clustered data ontap	View
8	netapp	hci management node	View
9	netapp	solidfire	View
10	netapp	hci storage node	View
11	netapp	hci bootstrap os	View
12	netapp	hci compute node	View
13	apple	mac os x	View
14	apple	mac os x	View
15	apple	mac os x	View
16	apple	mac os x	View
17	apple	macos	View
18	apple	macos	View
19	apple	macos	View
20	oracle	communications billing and revenue management	View
21	oracle	communications cloud native core policy	View
22	oracle	essbase	View
23	oracle	peoplesoft enterprise peopletools	View
24	fujitsu	m10-1 firmware	View
25	fujitsu	m10-1	View
26	fujitsu	m10-4 firmware	View
27	fujitsu	m10-4	View
28	fujitsu	m10-4s firmware	View
29	fujitsu	m10-4s	View
30	fujitsu	m12-1 firmware	View
31	fujitsu	m12-1	View
32	fujitsu	m12-2 firmware	View
33	fujitsu	m12-2	View
34	fujitsu	m12-2s firmware	View
35	fujitsu	m12-2s	View
36	fujitsu	m10-1 firmware	View
37	fujitsu	m10-4 firmware	View
38	fujitsu	m10-4s firmware	View
39	fujitsu	m12-1 firmware	View
40	fujitsu	m12-2 firmware	View
41	fujitsu	m12-2s firmware	View
42	siemens	sinec infrastructure network services	View
43	splunk	universal forwarder	View
44	splunk	universal forwarder	View
45	splunk	universal forwarder	View

Total affected vendors: 10|Products: 45

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCORE	VERSION	SEVERITY	VECTOR	SOURCE
4.3	CVSS V2	—	AV:N/AC:M/Au:N/C:P/I:N/A:N	NVD
3.7	CVSS V31	LOW	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N	NVD
3.7	CVSS V3_1	LOW	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N	CVE ADP

Patch and Remediation Guide