CVE-2020-36617 MEDIUM

CVE-2020-36617: ewxrjk sftpserver parse.c sftp_parse_path uninitialized pointer

Vendor Ewxrjk
Product sftpserver
Weakness CWE-908
Published December 18, 2022
Last update April 15, 2025
View on NVD All CVEs

CVSS base score

4.6/10
Attack vector Adjacent
Attack complexity High
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A vulnerability was found in ewxrjk sftpserver. It has been declared as problematic. Affected by this vulnerability is the function sftp_parse_path of the file parse.c. The manipulation leads to uninitialized pointer. The real existence of this vulnerability is still doubted at the moment. The name of the patch is bf4032f34832ee11d79aa60a226cc018e7ec5eed. It is recommended to apply a patch to fix this issue. The identifier VDB-216205 was assigned to this vulnerability. NOTE: In some deployment models this would be a vulnerability. README specifically warns about avoiding such deployment models.

Key dates

02Disclosure timeline

December 18, 2022 CVE published
April 15, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-34543 OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl) CVE-2025-31649 Dell ControlVault3 ControlVault WBDI Driver hard-coded password vulnerability CVE-2026-6686 FatFs Use of Uninitialized Clusters After Seek Past EOF CVE-2025-12736 multimedia_audio_standard has an insecure storage of sensitive information vulnerability CVE-2026-53467 ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged