CVE-2020-15152

Source
https://nvd.nist.gov/vuln/detail/CVE-2020-15152
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-15152.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2020-15152
Aliases
Related
Published
2020-08-17T22:15:12Z
Modified
2025-01-08T10:27:28.272722Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
[none]
Details

ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.19.6, 3.1.2, and 4.3.4 are vulnerable to Server-Side Request Forgery. The PORT command allows arbitrary IPs which can be used to cause the server to make a connection elsewhere. A possible workaround is blocking the PORT through the configuration. This issue is fixed in version2 2.19.6, 3.1.2, and 4.3.4. More information can be found on the linked advisory.

References

Affected packages

Git / github.com/autovance/ftp-srv

Affected ranges

Type
GIT
Repo
https://github.com/autovance/ftp-srv
Events
Type
GIT
Repo
https://github.com/quorumdms/ftp-srv
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Fixed

Affected versions

v1.*

v1.0.0
v1.1.0
v1.2.0

v2.*

v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.10.0
v2.10.1
v2.11.0
v2.11.1
v2.11.2
v2.11.3
v2.11.4
v2.12.0
v2.13.0
v2.13.1
v2.13.2
v2.13.3
v2.14.0
v2.15.0
v2.16.0
v2.16.1
v2.16.2
v2.17.0
v2.18.0
v2.19.0
v2.19.1
v2.19.2
v2.19.3
v2.19.4
v2.19.5
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.4.0
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v2.7.3
v2.8.0
v2.9.0
v2.9.1
v2.9.2

v3.*

v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.1.0
v3.1.1

v4.*

v4.0.0
v4.0.1
v4.1.0
v4.1.1
v4.2.0
v4.3.0
v4.3.1
v4.3.2
v4.3.3