CVE-2020-8177

HIGH

curl 7.20.0-7.70.0 - Arbitrary File Overwrite via -J Flag

Title source: llm

Description

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

References (5)

Core 5

Core References

Exploit, Third Party Advisory x_refsource_misc

https://hackerone.com/reports/887462

Vendor Advisory x_refsource_misc

https://curl.se/docs/CVE-2020-8177.html

Third Party Advisory vendor-advisory x_refsource_debian

https://www.debian.org/security/2021/dsa-4881

Patch, Third Party Advisory x_refsource_misc

https://www.oracle.com/security-alerts/cpujan2022.html

Patch, Third Party Advisory x_refsource_confirm

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Scores

CVSS v3 7.8

EPSS 0.0002

EPSS Percentile 5.3%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-74 CWE-99

Status published

Products (12)

None/https://github.com/curl/curl curl 7.20.0 to and including 7.70.0

debian/debian_linux 10.0

fujitsu/m10-1_firmware < xcp2410

fujitsu/m10-4_firmware < xcp2410

fujitsu/m10-4s_firmware < xcp2410

fujitsu/m12-1_firmware < xcp2410

fujitsu/m12-2_firmware < xcp2410

fujitsu/m12-2s_firmware < xcp2410

haxx/curl 7.20.0 - 7.70.0

siemens/sinec_infrastructure_network_services < 1.0.1.1

... and 2 more

Published Dec 14, 2020

Tracked Since Feb 18, 2026