CVE-2020-15778

Katalog CVE

CVSS 7.4 · High EPSS 13,0%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada openbsd openssh, netapp a700s firmware +7 lainnya. Skor CVSS 3.1 7.4 (High) menurut NVD.

Deskripsi (NVD)

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Rincian

Terbit di NVD

24 Juli 2020

Terakhir diubah

14 Oktober 2026

Status NVD

Modified

CVSS 3.1

7.4 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

13,0% peluang dieksploitasi; lebih tinggi dari 96,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.openssh.com/security.html advisory vendor
• https://access.redhat.com/errata/RHSA-2024:3166 advisory pihak ketiga
• https://github.com/cpandya2909/CVE-2020-15778/ exploit · advisory pihak ketiga
• https://news.ycombinator.com/item?id=25005567 advisory pihak ketiga
• https://security.gentoo.org/glsa/202212-06 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20200731-0007/ advisory pihak ketiga
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html