LiveActive security incident?Get immediate response
CVE Record

CVE-2020-8284: A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a...

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

LowCVSS 3.7Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2020-8284 lets a malicious FTP server influence vulnerable curl clients into connecting to an IP address and port chosen by the server. The main business risk is information exposure from internal services, such as service banners or open-port visibility, when curl is used against untrusted FTP servers.

Executive priority

Treat as a low-severity but legitimate information exposure issue. Prioritize normal patch cycles, with faster action for environments where automated jobs retrieve FTP content from untrusted or partner-controlled servers.

Technical view

curl 7.73.0 and earlier mishandle FTP PASV responses, allowing a malicious server to redirect the client connection target. The CVE describes potential private service discovery, including port scanning and banner extraction. CVSS is 3.7 with high attack complexity and low confidentiality impact.

Likely exposure

Exposure is most likely where curl or libcurl 7.73.0 or earlier is used for FTP, especially against external or user-controlled FTP servers. Systems that do not use FTP through curl have lower practical exposure based on the provided sources.

Exploitation context

The provided bundle does not show CISA KEV listing or active exploitation evidence. Exploitation requires a malicious FTP server and a vulnerable curl client connecting to it, so this is targeted rather than broadly wormable.

Researcher notes

The key condition is client-side FTP PASV handling against a malicious server. The source bundle supports confidentiality impact only, not integrity or availability impact. Do not assume active exploitation, affected non-curl products, or a universal fixed version without checking each vendor advisory.

Mitigation direction

  • Apply vendor curl or libcurl security updates for affected systems.
  • Check curl advisory and OS vendor guidance for fixed package versions.
  • Avoid using affected curl versions with untrusted FTP servers.
  • Review appliances and bundled software that may embed libcurl.
  • Use egress controls to limit unexpected internal service probing.

Validation and detection

  • Inventory curl and libcurl versions across hosts, containers, and appliances.
  • Flag curl or libcurl 7.73.0 and earlier for remediation review.
  • Identify workflows that use curl or libcurl with FTP URLs.
  • Check vendor advisories for packaged fixes in each distribution.
  • Confirm updated packages are deployed through standard vulnerability scans.
Prepared
Confidence
high
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-200: Information exposure and cloud metadata lookup

Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-8284 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Low
CVSS
3.7 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
17Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
3.7CVSS 3.1LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N2.21.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

3.7Low
CVSS 3.1 vector shape for CVE-2020-8284Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/ahttps://github.com/curl/curl7.73.0 and earlierListed
Weakness

CWE details

CWE-200

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-200 · source CWE mapping

Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs