{"id":"CVE-2020-8284","title":"A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and n…","summary":"A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and n…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-200"],"vendor":"haxx","product":"curl","affected":["curl <= 7.73.0","fedora = 32","fedora = 33","debian_linux = 9.0","debian_linux = 10.0","clustered_data_ontap","hci_management_node","solidfire","hci_storage_node","hci_bootstrap_os","mac_os_x >= 10.14.0, < 10.14.6","mac_os_x >= 10.15, < 10.15.7","mac_os_x = 10.14.6","mac_os_x = 10.15.7","macos = 11.0.1","macos = 11.1","macos = 11.2","communications_billing_and_revenue_management = 12.0.0.3.0","communications_cloud_native_core_policy = 1.14.0","essbase = 21.2","peoplesoft_enterprise_peopletools = 8.58","m10-1_firmware < xcp2410","m10-4_firmware < xcp2410","m10-4s_firmware < xcp2410","m12-1_firmware < xcp2410","m12-2_firmware < xcp2410","m12-2s_firmware < xcp2410","m10-1_firmware < xcp3110","m10-4_firmware < xcp3110","m10-4s_firmware < xcp3110","m12-1_firmware < xcp3110","m12-2_firmware < xcp3110","m12-2s_firmware < xcp3110","sinec_infrastructure_network_services < 1.0.1.1","universal_forwarder >= 8.2.0, < 8.2.12","universal_forwarder >= 9.0.0, < 9.0.6","universal_forwarder = 9.1.0"],"patched":["mac_os_x 10.15.7","m10-1_firmware xcp3110","m10-4_firmware xcp3110","m10-4s_firmware xcp3110","m12-1_firmware xcp3110","m12-2_firmware xcp3110","m12-2s_firmware xcp3110","sinec_infrastructure_network_services 1.0.1.1","universal_forwarder 9.0.6"],"published":"2020-12-14","updated":"2026-10-14","sourceUpdated":"2026-10-14T09:17:20.200","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-8284","references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","label":"support@hackerone.com"},{"url":"https://curl.se/docs/CVE-2020-8284.html","label":"support@hackerone.com"},{"url":"https://hackerone.com/reports/1040166","label":"support@hackerone.com"},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html","label":"support@hackerone.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/","label":"support@hackerone.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/","label":"support@hackerone.com"},{"url":"https://security.gentoo.org/glsa/202012-14","label":"support@hackerone.com"},{"url":"https://security.netapp.com/advisory/ntap-20210122-0007/","label":"support@hackerone.com"},{"url":"https://support.apple.com/kb/HT212325","label":"support@hackerone.com"},{"url":"https://support.apple.com/kb/HT212326","label":"support@hackerone.com"},{"url":"https://support.apple.com/kb/HT212327","label":"support@hackerone.com"},{"url":"https://www.debian.org/security/2021/dsa-4881","label":"support@hackerone.com"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"support@hackerone.com"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","label":"support@hackerone.com"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"support@hackerone.com"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"support@hackerone.com"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://curl.se/docs/CVE-2020-8284.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://hackerone.com/reports/1040166","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202012-14","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20210122-0007/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT212325","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT212326","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT212327","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2021/dsa-4881","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-389290.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd"],"epss":0.03898,"epssPercentile":0.9004,"ingestedAt":"2026-10-14T09:24:26.058Z","slug":"CVE-2020-8284","body":"## Overview\n\nA malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.\n\n## Affected\n\n- `curl <= 7.73.0`\n- `fedora = 32`\n- `fedora = 33`\n- `debian_linux = 9.0`\n- `debian_linux = 10.0`\n- `clustered_data_ontap`\n- `hci_management_node`\n- `solidfire`\n- `hci_storage_node`\n- `hci_bootstrap_os`\n- `mac_os_x >= 10.14.0, < 10.14.6`\n- `mac_os_x >= 10.15, < 10.15.7`\n- `mac_os_x = 10.14.6`\n- `mac_os_x = 10.15.7`\n- `macos = 11.0.1`\n- `macos = 11.1`\n- `macos = 11.2`\n- `communications_billing_and_revenue_management = 12.0.0.3.0`\n- `communications_cloud_native_core_policy = 1.14.0`\n- `essbase = 21.2`\n- `peoplesoft_enterprise_peopletools = 8.58`\n- `m10-1_firmware < xcp2410`\n- `m10-4_firmware < xcp2410`\n- `m10-4s_firmware < xcp2410`\n- `m12-1_firmware < xcp2410`\n- `m12-2_firmware < xcp2410`\n- `m12-2s_firmware < xcp2410`\n- `m10-1_firmware < xcp3110`\n- `m10-4_firmware < xcp3110`\n- `m10-4s_firmware < xcp3110`\n- `m12-1_firmware < xcp3110`\n- `m12-2_firmware < xcp3110`\n- `m12-2s_firmware < xcp3110`\n- `sinec_infrastructure_network_services < 1.0.1.1`\n- `universal_forwarder >= 8.2.0, < 8.2.12`\n- `universal_forwarder >= 9.0.0, < 9.0.6`\n- `universal_forwarder = 9.1.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `mac_os_x 10.15.7`\n- `m10-1_firmware xcp3110`\n- `m10-4_firmware xcp3110`\n- `m10-4s_firmware xcp3110`\n- `m12-1_firmware xcp3110`\n- `m12-2_firmware xcp3110`\n- `m12-2s_firmware xcp3110`\n- `sinec_infrastructure_network_services 1.0.1.1`\n- `universal_forwarder 9.0.6`","depth":"sunlit","depthScore":21,"depthScoreParts":{"impact":20.4,"likelihood":0.8,"exploitation":0,"ransomware":0},"changes":[]}