CVE-2020-8284: haxx curl +21 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2020-8284

CVSS 3.7 · Low EPSS 3,9%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada haxx curl, fedoraproject fedora +20 lainnya. Skor CVSS 3.1 3.7 (Low) menurut NVD.

Deskripsi (NVD)

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

Rincian

Terbit di NVD: 14 Desember 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 3.7 (Low), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
EPSS (30 hari): 3,9% peluang dieksploitasi; lebih tinggi dari 90,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
haxx	curl	Semua versi hingga 7.73.0
fedoraproject	fedora	Versi 32
fedoraproject	fedora	Versi 33
debian	debian linux	Versi 9.0
debian	debian linux	Versi 10.0
netapp	clustered data ontap	Semua versi
netapp	hci management node	Semua versi
netapp	solidfire	Semua versi
netapp	hci storage node	Semua versi
netapp	hci bootstrap os	Semua versi
apple	mac os x	Versi 10.14.0 hingga sebelum 10.14.6
apple	mac os x	Versi 10.15 hingga sebelum 10.15.7
apple	mac os x	Versi 10.14.6 security_update_2019-001
apple	mac os x	Versi 10.14.6 security_update_2019-002
apple	mac os x	Versi 10.14.6 security_update_2019-004
apple	mac os x	Versi 10.14.6 security_update_2019-005
apple	mac os x	Versi 10.14.6 security_update_2019-006
apple	mac os x	Versi 10.14.6 security_update_2019-007
apple	mac os x	Versi 10.14.6 security_update_2020-001
apple	mac os x	Versi 10.14.6 security_update_2020-002
apple	mac os x	Versi 10.14.6 security_update_2020-003
apple	mac os x	Versi 10.14.6 security_update_2020-004
apple	mac os x	Versi 10.14.6 security_update_2020-005
apple	mac os x	Versi 10.14.6 security_update_2020-006
apple	mac os x	Versi 10.14.6 security_update_2020-007
apple	mac os x	Versi 10.14.6 security_update_2021-001
apple	mac os x	Versi 10.14.6 security_update_2021-002
apple	mac os x	Versi 10.14.6 supplemental_update
apple	mac os x	Versi 10.14.6 supplemental_update_2
apple	mac os x	Versi 10.15.7
apple	mac os x	Versi 10.15.7 security_update_2020
apple	mac os x	Versi 10.15.7 security_update_2020-001
apple	mac os x	Versi 10.15.7 security_update_2020-005
apple	mac os x	Versi 10.15.7 security_update_2020-007
apple	mac os x	Versi 10.15.7 security_update_2021-001
apple	mac os x	Versi 10.15.7 supplemental_update
apple	macos	Versi 11.0.1
apple	macos	Versi 11.1
apple	macos	Versi 11.2
oracle	communications billing and revenue management	Versi 12.0.0.3.0
oracle	communications cloud native core policy	Versi 1.14.0
oracle	essbase	Versi 21.2
oracle	peoplesoft enterprise peopletools	Versi 8.58
fujitsu	m10-1 firmware	Semua versi sebelum xcp2410
fujitsu	m10-4 firmware	Semua versi sebelum xcp2410
fujitsu	m10-4s firmware	Semua versi sebelum xcp2410
fujitsu	m12-1 firmware	Semua versi sebelum xcp2410
fujitsu	m12-2 firmware	Semua versi sebelum xcp2410
fujitsu	m12-2s firmware	Semua versi sebelum xcp2410
fujitsu	m10-1 firmware	Semua versi sebelum xcp3110
fujitsu	m10-4 firmware	Semua versi sebelum xcp3110
fujitsu	m10-4s firmware	Semua versi sebelum xcp3110
fujitsu	m12-1 firmware	Semua versi sebelum xcp3110
fujitsu	m12-2 firmware	Semua versi sebelum xcp3110
fujitsu	m12-2s firmware	Semua versi sebelum xcp3110
siemens	sinec infrastructure network services	Semua versi sebelum 1.0.1.1
splunk	universal forwarder	Versi 8.2.0 hingga sebelum 8.2.12
splunk	universal forwarder	Versi 9.0.0 hingga sebelum 9.0.6
splunk	universal forwarder	Versi 9.1.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://curl.se/docs/CVE-2020-8284.html advisory vendor
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf patch · advisory pihak ketiga
https://www.oracle.com//security-alerts/cpujul2021.html patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpuApr2021.html patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html mailing list · advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4A... mailing list · advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHM... mailing list · advisory pihak ketiga
https://security.gentoo.org/glsa/202012-14 advisory pihak ketiga
https://security.netapp.com/advisory/ntap-20210122-0007/ advisory pihak ketiga
https://support.apple.com/kb/HT212325 advisory pihak ketiga
https://support.apple.com/kb/HT212326 advisory pihak ketiga
https://support.apple.com/kb/HT212327 advisory pihak ketiga
https://www.debian.org/security/2021/dsa-4881 advisory pihak ketiga
https://hackerone.com/reports/1040166 permissions required

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.