CVE-2020-8177

moderate-risk
Published 2020-12-14

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

Do I need to act?

-
0.02% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10 High
LOCAL / LOW complexity

Affected Products (11)

M12-1 Firmware
M12-2 Firmware
M12-2S Firmware

Affected Vendors

Debian Siemens Fujitsu Haxx Splunk

References (10)

Patch https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Vendor Advisory https://curl.se/docs/CVE-2020-8177.html
Exploit https://hackerone.com/reports/887462
Third Party Advisory https://www.debian.org/security/2021/dsa-4881
Patch https://www.oracle.com/security-alerts/cpujan2022.html
Patch https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Vendor Advisory https://curl.se/docs/CVE-2020-8177.html
Exploit https://hackerone.com/reports/887462
Third Party Advisory https://www.debian.org/security/2021/dsa-4881
Patch https://www.oracle.com/security-alerts/cpujan2022.html
40
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 0/34 · Minimal
Exposure 16/34 · Moderate