ZeroDay Findings
Sign inSign up

Findings

CVE-2020-8284

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make cu…

Published Dec 14, 2020 · updated Oct 14, 2026 · haxx curl

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 14, 2020 · NIST NVD

    Detected

    A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

  2. Oct 14, 2026 · NIST NVD

    Updated

    A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

Affected

  • cpe apple/mac os xversion unspecified
  • cpe debian/debian linux10.0
  • cpe debian/debian linux9.0
  • cpe fedoraproject/fedora32
  • cpe fedoraproject/fedora33
  • cpe fujitsu/m10-1 firmwareversion unspecified
  • cpe haxx/curlversion unspecified
  • cpe netapp/clustered data ontapversion unspecified
  • cpe netapp/hci bootstrap osversion unspecified
  • cpe netapp/hci management nodeversion unspecified
  • cpe netapp/solidfireversion unspecified
  • cpe oracle/communications billing and revenue management12.0.0.3.0

Sources

  • CVE.orgVulnerability recordCVE-2020-8284

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2020-8284

    30-day exploitation probability 3.9%

    first.org
  • NIST NVDVulnerability recordCVE-2020-8284

    A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanni

    nvd.nist.gov

References