CVE-2020-15152

Server-Side Request Forgery in ftp-srv

State: Published
Severity: 9.1 Critical
Published: Aug 17, 2020
Updated: Aug 4, 2024
Reserved: Jun 25, 2020

Description

ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.19.6, 3.1.2, and 4.3.4 are vulnerable to Server-Side Request Forgery. The PORT command allows arbitrary IPs which can be used to cause the server to make a connection elsewhere. A possible workaround is blocking the PORT through the configuration. This issue is fixed in version2 2.19.6, 3.1.2, and 4.3.4. More information can be found on the linked advisory.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	GitHub_M

Weaknesses

CWE-918 {"CWE-918":"Server-Side Request Forgery (SSRF)"}

Affected Products

Product	Versions
ftp-srvautovance	>= 1.0.0, < 2.19.6Affected >= 3.0.0, < 3.1.2Affected >= 4.0.0, < 4.3.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.