CVE-2020-15152

Katalog CVE

CVSS 9.1 · Critical EPSS 1,9%

Kerentanan Server-Side Request Forgery (SSRF) pada ftp-srv project ftp-srv. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.19.6, 3.1.2, and 4.3.4 are vulnerable to Server-Side Request Forgery. The PORT command allows arbitrary IPs which can be used to cause the server to make a connection elsewhere. A possible workaround is blocking the PORT through the configuration. This issue is fixed in version2 2.19.6, 3.1.2, and 4.3.4. More information can be found on the linked advisory.

Rincian

Terbit di NVD

17 Agustus 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 78,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/autovance/ftp-srv/commit/e449e75219d918c400dec65b4b0759f60476abca patch · advisory pihak ketiga
• https://github.com/autovance/ftp-srv/security/advisories/GHSA-jw37-5gqr-cf9j mitigasi · patch · advisory pihak ketiga
• https://www.npmjs.com/package/ftp-srv product · advisory pihak ketiga