{"id":"CVE-2020-8284","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-8284","generatedAt":"2026-10-28T04:17:23.978Z","title":"A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed,…","description":"A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.","published":"2020-12-14T20:15:14.000Z","lastModified":"2026-10-14T09:17:20.000Z","status":"Modified","sourceIdentifier":"support@hackerone.com","cvss":{"version":"3.1","score":3.7,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cwe":["CWE-200"],"affected":["haxx/curl","fedoraproject/fedora","debian/debian linux","netapp/clustered data ontap","netapp/hci management node","netapp/solidfire","netapp/hci storage node","netapp/hci bootstrap os","apple/mac os x","apple/macos","oracle/communications billing and revenue management","oracle/communications cloud native core policy","oracle/essbase","oracle/peoplesoft enterprise peopletools","fujitsu/m10-1 firmware","fujitsu/m10-4 firmware","fujitsu/m10-4s firmware","fujitsu/m12-1 firmware","fujitsu/m12-2 firmware","fujitsu/m12-2s firmware","siemens/sinec infrastructure network services","splunk/universal forwarder"],"epss":{"score":0.03898,"percentile":0.90202,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (3.90%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","tags":["Patch","Third Party Advisory"],"source":"support@hackerone.com"},{"url":"https://curl.se/docs/CVE-2020-8284.html","tags":["Vendor Advisory"],"source":"support@hackerone.com"},{"url":"https://hackerone.com/reports/1040166","tags":["Permissions Required"],"source":"support@hackerone.com"},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html","tags":["Mailing List","Third Party Advisory"],"source":"support@hackerone.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/","tags":["Mailing List","Third Party Advisory"],"source":"support@hackerone.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/","tags":["Mailing List","Third Party Advisory"],"source":"support@hackerone.com"},{"url":"https://security.gentoo.org/glsa/202012-14","tags":["Third Party Advisory"],"source":"support@hackerone.com"},{"url":"https://security.netapp.com/advisory/ntap-20210122-0007/","tags":["Third Party Advisory"],"source":"support@hackerone.com"},{"url":"https://support.apple.com/kb/HT212325","tags":["Third Party Advisory"],"source":"support@hackerone.com"},{"url":"https://support.apple.com/kb/HT212326","tags":["Third Party Advisory"],"source":"support@hackerone.com"},{"url":"https://support.apple.com/kb/HT212327","tags":["Third Party Advisory"],"source":"support@hackerone.com"},{"url":"https://www.debian.org/security/2021/dsa-4881","tags":["Third Party Advisory"],"source":"support@hackerone.com"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["Patch","Third Party Advisory"],"source":"support@hackerone.com"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["Patch","Third Party Advisory"],"source":"support@hackerone.com"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"],"source":"support@hackerone.com"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["Patch","Third Party Advisory"],"source":"support@hackerone.com"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://curl.se/docs/CVE-2020-8284.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://hackerone.com/reports/1040166","tags":["Permissions Required"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202012-14","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20210122-0007/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT212325","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT212326","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT212327","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2021/dsa-4881","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-389290.html","source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-8284","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}