Vulnerabilities > CVE-2020-15152 - Server-Side Request Forgery (SSRF) vulnerability in Ftp-Srv Project Ftp-Srv

CVSS 9.1 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

ftp-srv-project

CWE-918

critical

NVD

Published: 2020-08-17

Updated: 2024-11-21

Summary

ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.19.6, 3.1.2, and 4.3.4 are vulnerable to Server-Side Request Forgery. The PORT command allows arbitrary IPs which can be used to cause the server to make a connection elsewhere. A possible workaround is blocking the PORT through the configuration. This issue is fixed in version2 2.19.6, 3.1.2, and 4.3.4. More information can be found on the linked advisory.

Vulnerable Configurations

Part	Description	Count
Application	Ftp-Srv_Project FTP SRV Project FTP SRV 4.0.0 FTP SRV Project FTP SRV 4.0.1 FTP SRV Project FTP SRV 4.1.0 FTP SRV Project FTP SRV 4.1.1 FTP SRV Project FTP SRV 4.2.0 FTP SRV Project FTP SRV 4.3.0 FTP SRV Project FTP SRV 4.3.1 FTP SRV Project FTP SRV 4.3.2 FTP SRV Project FTP SRV 4.3.3 FTP SRV Project FTP SRV 3.0.0 FTP SRV Project FTP SRV 3.0.1 FTP SRV Project FTP SRV 3.0.2 FTP SRV Project FTP SRV 3.0.3 FTP SRV Project FTP SRV 3.0.4 FTP SRV Project FTP SRV 3.0.5 FTP SRV Project FTP SRV 3.0.6 FTP SRV Project FTP SRV 3.1.0 FTP SRV Project FTP SRV 3.1.1 FTP SRV Project FTP SRV 1.0.0 FTP SRV Project FTP SRV 1.1.0 FTP SRV Project FTP SRV 1.2.0 FTP SRV Project FTP SRV 2.0.0 FTP SRV Project FTP SRV 2.0.1 FTP SRV Project FTP SRV 2.0.2 FTP SRV Project FTP SRV 2.1.0 FTP SRV Project FTP SRV 2.2.0 FTP SRV Project FTP SRV 2.2.1 FTP SRV Project FTP SRV 2.3.0 FTP SRV Project FTP SRV 2.3.1 FTP SRV Project FTP SRV 2.4.0 FTP SRV Project FTP SRV 2.5.0 FTP SRV Project FTP SRV 2.6.0 FTP SRV Project FTP SRV 2.7.0 FTP SRV Project FTP SRV 2.7.1 FTP SRV Project FTP SRV 2.7.2 FTP SRV Project FTP SRV 2.7.3 FTP SRV Project FTP SRV 2.8.0 FTP SRV Project FTP SRV 2.9.0 FTP SRV Project FTP SRV 2.9.1 FTP SRV Project FTP SRV 2.9.2 FTP SRV Project FTP SRV 2.10.0 FTP SRV Project FTP SRV 2.10.1 FTP SRV Project FTP SRV 2.11.0 FTP SRV Project FTP SRV 2.11.1 FTP SRV Project FTP SRV 2.11.2 FTP SRV Project FTP SRV 2.11.3 FTP SRV Project FTP SRV 2.11.4 FTP SRV Project FTP SRV 2.12.0 FTP SRV Project FTP SRV 2.13.0 FTP SRV Project FTP SRV 2.13.1 FTP SRV Project FTP SRV 2.13.2 FTP SRV Project FTP SRV 2.13.3 FTP SRV Project FTP SRV 2.14.0 FTP SRV Project FTP SRV 2.15.0 FTP SRV Project FTP SRV 2.16.0 FTP SRV Project FTP SRV 2.16.1 FTP SRV Project FTP SRV 2.16.2 FTP SRV Project FTP SRV 2.17.0 FTP SRV Project FTP SRV 2.18.0 FTP SRV Project FTP SRV 2.19.0 FTP SRV Project FTP SRV 2.19.1 FTP SRV Project FTP SRV 2.19.2 FTP SRV Project FTP SRV 2.19.3 FTP SRV Project FTP SRV 2.19.4 FTP SRV Project FTP SRV 2.19.5	65

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References