CVE-2020-15778

** DISPUTED ** scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Link	Resource
https://github.com/cpandya2909/CVE-2020-15778/	Exploit Third Party Advisory
https://www.openssh.com/security.html	Vendor Advisory
https://security.netapp.com/advisory/ntap-20200731-0007/	Third Party Advisory
https://news.ycombinator.com/item?id=25005567	Third Party Advisory
https://security.gentoo.org/glsa/202212-06	Third Party Advisory

Configuration 1

cpe:2.3:a:openbsd:openssh:8.3:p1:*:*:*:*:*:* cpe:2.3:a:openbsd:openssh:8.3:-:*:*:*:*:*:* cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:*

---

Published : 2020-07-24 02:15

Updated : 2023-02-24 07:43

---

NVD link : CVE-2020-15778

Mitre link : CVE-2020-15778

A700s Firmware

Netapp

CWE-78