ByteOS Network

NVD Vulnerability Details :

CVE-2020-15152

Analyzed

Source-security-advisories@github.com

Published At-17 Aug, 2020 | 22:15

Updated At-05 May, 2021 | 14:02

ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.19.6, 3.1.2, and 4.3.4 are vulnerable to Server-Side Request Forgery. The PORT command allows arbitrary IPs which can be used to cause the server to make a connection elsewhere. A possible workaround is blocking the PORT through the configuration. This issue is fixed in version2 2.19.6, 3.1.2, and 4.3.4. More information can be found on the linked advisory.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Secondary	3.1	9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N

CPE Matches

ftp-srv_project>>ftp-srv>>Versions before 2.19.6(exclusive)

cpe:2.3:a:ftp-srv_project:ftp-srv:*:*:*:*:*:node.js:*:*

ftp-srv_project>>ftp-srv>>Versions from 3.0.0(inclusive) to 3.1.2(exclusive)

cpe:2.3:a:ftp-srv_project:ftp-srv:*:*:*:*:*:node.js:*:*

ftp-srv_project>>ftp-srv>>Versions from 4.0.0(inclusive) to 4.3.4(exclusive)

cpe:2.3:a:ftp-srv_project:ftp-srv:*:*:*:*:*:node.js:*:*

Weaknesses

CWE ID	Type	Source
CWE-918	Primary	nvd@nist.gov
CWE-918	Secondary	security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/autovance/ftp-srv/commit/e449e75219d918c400dec65b4b0759f60476abca	security-advisories@github.com	Patch Third Party Advisory
https://github.com/autovance/ftp-srv/security/advisories/GHSA-jw37-5gqr-cf9j	security-advisories@github.com	Mitigation Patch Third Party Advisory
https://www.npmjs.com/package/ftp-srv	security-advisories@github.com	Product Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History