Every CVE Search/ Get API key

CVE-2020-15778

scp in OpenSSH through 8.3p1 allows command injection in scp.c remote function, as demonstrated...

7.4 HighPublic exploitFix availableDisputed

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

13.7%Up 9.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.4

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Record
CVE-2020-15778
CVSS 3.1
7.4 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-78
Updated
2026-11-02
CVE List 7.8

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Record
CVE-2020-15778
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
EUVDEUVD-2020-7762 7.8

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Record
EUVD-2020-7762
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-cvxm-8hgf-6m6m 7.8

scp in OpenSSH through 8.3p1 allows command injection in scp.c remote function, as demonstrated...

scp in OpenSSH through 8.3p1 allows command injection in scp.c remote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Record
GHSA-cvxm-8hgf-6m6m
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
OSVALPINE-CVE-2020-15778 7.4

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Record
ALPINE-CVE-2020-15778
CVSS 3.1
7.4 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2020-15778 7.4

CVE-2020-15778 does not affect BellSoft software

Record
BELL-CVE-2020-15778
CVSS 3.1
7.4 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSV 7.4

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Record
CVE-2020-15778
CVSS 3.1
7.4 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-15778 7.4

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Record
DEBIAN-CVE-2020-15778
CVSS 3.1
7.4 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2021-1377 8.8

openssh security update

OpenSSH is the premier connectivity tool for remote login with the SSH protocol. It encrypts all traffic to eliminate eavesdropping, connection hijacking, and other attacks. In addition, OpenSSH provides a large suite of secure tunneling capabilities, several authentication methods, and sophisticated configuration options.

Security Fix(es):

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.(CVE-2021-41617)

scp in OpenSSH through 8.3p1 allows command injection in scp.c remote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of anomalous argument transfers because that could stand a great chance of breaking existing workflows.(CVE-2020-15778)

Record
OESA-2021-1377
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:3166 4.1

Red Hat Security Advisory: openssh security update

Record
RHSA-2024:3166
CVSS 3.1
4.1 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVRLSA-2024:3166 7.8

Moderate: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es):

  • openssh: scp allows command injection when using backtick characters in the destination argument (CVE-2020-15778)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

Record
RLSA-2024:3166
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-15778 7.4

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Record
UBUNTU-CVE-2020-15778
CVSS 3.1
7.4 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2024:3166 No score

Moderate: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es):

  • openssh: scp allows command injection when using backtick characters in the destination argument (CVE-2020-15778)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2024:3166
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssh
Alpine:v3.19
 before 8.3_p1-r0
8.3_p1-r0
openssh
Alpine:v3.20
 before 8.3_p1-r0
8.3_p1-r0
openssh
Alpine:v3.21
 before 8.3_p1-r0
8.3_p1-r0
openssh
Alpine:v3.22
 before 8.3_p1-r0
8.3_p1-r0
openssh
Alpine:v3.23
 before 8.3_p1-r0
8.3_p1-r0
openssh
Alpine:v3.24
 before 8.3_p1-r0
8.3_p1-r0
openssh
AlmaLinux:8
 before 8.0p1-24.el8
8.0p1-24.el8
openssh-askpass
AlmaLinux:8
 before 8.0p1-24.el8
8.0p1-24.el8
openssh-cavs
AlmaLinux:8
 before 8.0p1-24.el8
8.0p1-24.el8
openssh-clients
AlmaLinux:8
 before 8.0p1-24.el8
8.0p1-24.el8
Show 42 moreShow less
Affected packages
PackageAffectedFixed
openssh-keycat
AlmaLinux:8
 before 8.0p1-24.el8
8.0p1-24.el8
openssh-ldap
AlmaLinux:8
 before 8.0p1-24.el8
8.0p1-24.el8
openssh-server
AlmaLinux:8
 before 8.0p1-24.el8
8.0p1-24.el8
pam_ssh_agent_auth
AlmaLinux:8
 before 0.10.3-7.24.el8
0.10.3-7.24.el8
openssh
Debian:12
 All versions, plus listed versions
1:10.0p1-11:10.0p1-21:10.0p1-31:10.0p1-41:10.0p1-5
Show 45 moreShow less
1:10.0p1-5~bpo12+21:10.0p1-61:10.0p1-71:10.0p1-7~bpo12+11:10.0p1-81:10.1p1-11:10.1p1-21:10.2p1-11:10.2p1-21:10.2p1-2~bpo13+11:10.2p1-31:10.2p1-41:10.2p1-51:10.2p1-61:10.2p1-6~bpo13+11:10.3p1-11:10.3p1-1~bpo13+11:10.3p1-21:10.3p1-31:10.3p1-41:10.3p1-51:10.3p1-71:10.3p1-81:10.3p1-91:10.4p1-11:10.4p1-21:10.4p1-31:10.4p1-41:10.4p1-51:10.5p1-11:10.6p1-11:9.2p1-21:9.2p1-2+deb12u11:9.2p1-2+deb12u101:9.2p1-2+deb12u21:9.2p1-2+deb12u31:9.2p1-2+deb12u41:9.2p1-2+deb12u51:9.2p1-2+deb12u61:9.2p1-2+deb12u71:9.2p1-2+deb12u81:9.2p1-2+deb12u91:9.3p1-11:9.3p1-1+loong641:9.3p2-1
 None known
openssh
Debian:13
 All versions, plus listed versions
1:10.0p1-71:10.0p1-7+deb13u11:10.0p1-7+deb13u21:10.0p1-7+deb13u31:10.0p1-7+deb13u4
Show 27 moreShow less
1:10.0p1-81:10.1p1-11:10.1p1-21:10.2p1-11:10.2p1-21:10.2p1-2~bpo13+11:10.2p1-31:10.2p1-41:10.2p1-51:10.2p1-61:10.2p1-6~bpo13+11:10.3p1-11:10.3p1-1~bpo13+11:10.3p1-21:10.3p1-31:10.3p1-41:10.3p1-51:10.3p1-71:10.3p1-81:10.3p1-91:10.4p1-11:10.4p1-21:10.4p1-31:10.4p1-41:10.4p1-51:10.5p1-11:10.6p1-1
 None known
openssh
Debian:14
 All versions, plus listed versions
1:10.0p1-71:10.0p1-81:10.1p1-11:10.1p1-21:10.2p1-1
Show 23 moreShow less
1:10.2p1-21:10.2p1-2~bpo13+11:10.2p1-31:10.2p1-41:10.2p1-51:10.2p1-61:10.2p1-6~bpo13+11:10.3p1-11:10.3p1-1~bpo13+11:10.3p1-21:10.3p1-31:10.3p1-41:10.3p1-51:10.3p1-71:10.3p1-81:10.3p1-91:10.4p1-11:10.4p1-21:10.4p1-31:10.4p1-41:10.4p1-51:10.5p1-11:10.6p1-1
 None known
openssh
openEuler:20.03-LTS-SP1
 before 8.2p1-14.oe1
8.2p1-14.oe1
openssh
openEuler:20.03-LTS-SP2
 before 8.2p1-14.oe1
8.2p1-14.oe1
openssh-askpass
Red Hat:enterprise_linux:8::appstream
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-askpass-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-cavs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-clients-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-keycat-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-ldap-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-server-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
pam_ssh_agent_auth-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.10.3-7.24.el8
0:0.10.3-7.24.el8
openssh
Red Hat:enterprise_linux:8::baseos
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-askpass-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-cavs
Red Hat:enterprise_linux:8::baseos
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-cavs-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-clients
Red Hat:enterprise_linux:8::baseos
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-clients-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-keycat
Red Hat:enterprise_linux:8::baseos
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-keycat-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-ldap
Red Hat:enterprise_linux:8::baseos
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-ldap-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-server
Red Hat:enterprise_linux:8::baseos
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh-server-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
pam_ssh_agent_auth
Red Hat:enterprise_linux:8::baseos
 before 0:0.10.3-7.24.el8
0:0.10.3-7.24.el8
pam_ssh_agent_auth-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:0.10.3-7.24.el8
0:0.10.3-7.24.el8
openssh
Rocky Linux:8
 before 0:8.0p1-24.el8
0:8.0p1-24.el8
openssh
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1:6.2p2-61:6.2p2-6ubuntu11:6.4p1-11:6.4p1-21:6.5p1-1
Show 22 moreShow less
1:6.5p1-21:6.5p1-31:6.5p1-41:6.5p1-61:6.6p1-11:6.6p1-21:6.6p1-2ubuntu11:6.6p1-2ubuntu21:6.6p1-2ubuntu2.21:6.6p1-2ubuntu2.31:6.6p1-2ubuntu2.41:6.6p1-2ubuntu2.61:6.6p1-2ubuntu2.71:6.6p1-2ubuntu2.81:6.6p1-2ubuntu2.101:6.6p1-2ubuntu2.111:6.6p1-2ubuntu2.121:6.6p1-2ubuntu2.131:6.6p1-2ubuntu2.13+esm11:6.6p1-2ubuntu2.13+esm21:6.6p1-2ubuntu2.13+esm31:6.6p1-2ubuntu2.13+esm4
 None known
openssh
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1:6.9p1-21:6.9p1-31:7.1p1-11:7.1p1-31:7.1p1-4
Show 27 moreShow less
1:7.1p1-61:7.1p2-11:7.1p2-21:7.2p1-11:7.2p2-11:7.2p2-21:7.2p2-31:7.2p2-41:7.2p2-4ubuntu11:7.2p2-4ubuntu2.11:7.2p2-4ubuntu2.21:7.2p2-4ubuntu2.41:7.2p2-4ubuntu2.51:7.2p2-4ubuntu2.61:7.2p2-4ubuntu2.71:7.2p2-4ubuntu2.81:7.2p2-4ubuntu2.101:7.2p2-4ubuntu2.10+esm11:7.2p2-4ubuntu2.10+esm21:7.2p2-4ubuntu2.10+esm31:7.2p2-4ubuntu2.10+esm41:7.2p2-4ubuntu2.10+esm51:7.2p2-4ubuntu2.10+esm61:7.2p2-4ubuntu2.10+esm71:7.2p2-4ubuntu2.10+esm81:7.2p2-4ubuntu2.10+esm91:7.2p2-4ubuntu2.10+esm10
 None known
openssh
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1:7.5p1-101:7.6p1-41:7.6p1-4ubuntu0.11:7.6p1-4ubuntu0.21:7.6p1-4ubuntu0.3
Show 9 moreShow less
1:7.6p1-4ubuntu0.51:7.6p1-4ubuntu0.61:7.6p1-4ubuntu0.71:7.6p1-4ubuntu0.7+esm11:7.6p1-4ubuntu0.7+esm21:7.6p1-4ubuntu0.7+esm31:7.6p1-4ubuntu0.7+esm41:7.6p1-4ubuntu0.7+esm51:7.6p1-4ubuntu0.7+esm6
 None known
openssh-ssh1
Ubuntu:18.04:LTS
 All versions, plus listed versions
1:7.5p1-81:7.5p1-91:7.5p1-9build11:7.5p1-10
 None known
openssh
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1:8.0p1-6build11:8.1p1-11:8.1p1-51:8.2p1-41:8.2p1-4ubuntu0.1
Show 14 moreShow less
1:8.2p1-4ubuntu0.21:8.2p1-4ubuntu0.31:8.2p1-4ubuntu0.41:8.2p1-4ubuntu0.51:8.2p1-4ubuntu0.71:8.2p1-4ubuntu0.81:8.2p1-4ubuntu0.91:8.2p1-4ubuntu0.101:8.2p1-4ubuntu0.111:8.2p1-4ubuntu0.121:8.2p1-4ubuntu0.131:8.2p1-4ubuntu0.13+esm11:8.2p1-4ubuntu0.13+esm21:8.2p1-4ubuntu0.13+esm3
 None known
openssh-ssh1
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:7.5p1-11build1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubNeko-chanQwQ/CVE-2020-15778-Exploit2021-07-15
PoC in GitHubcpandya2909/CVE-2020-157782020-07-18
PoC in GitHubdrackyjr/CVE-2020-15778-SCP-Command-Injection-Check2025-07-28
PoC in GitHubyifanzhg/CVE-2020-157782023-09-27

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-15778 is a high vulnerability (CVSS 7.4) in Openbsd Openssh, published July 24, 2020. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 13.7%, the 96th percentile. Fixed in openssh 8.3_p1-r0.

References

Show 25 moreShow less
This page doesn't list everything

Left out here: 28 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open