CVE-2020-15152

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-15152
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15152.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-15152
Aliases
Published
2020-08-17T22:15:12Z
Modified
2026-10-20T10:51:52Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
[none]
Details

ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.19.6, 3.1.2, and 4.3.4 are vulnerable to Server-Side Request Forgery. The PORT command allows arbitrary IPs which can be used to cause the server to make a connection elsewhere. A possible workaround is blocking the PORT through the configuration. This issue is fixed in version2 2.19.6, 3.1.2, and 4.3.4. More information can be found on the linked advisory.

References

Affected packages

Git / github.com/QuorumDMS/ftp-srv

Affected ranges

Type
GIT
Repo
https://github.com/QuorumDMS/ftp-srv
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
79438158f382b7677281f47d4297c3f9ca62f82a
Introduced
0afd578683f775eb5526bf196d7211580c0f97cc
Fixed
5508c2346cf23b24c20070ff2e8a47c647d3d5b5
Introduced
e5820688c4ad19e2352e9824b839a01a62c21ab7
Fixed
e449e75219d918c400dec65b4b0759f60476abca
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:ftp-srv_project:ftp-srv:*:*:*:*:*:node.js:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.19.6"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:ftp-srv_project:ftp-srv:*:*:*:*:*:node.js:*:*",
            "range":  [
                {
                    "introduced":  "3.0.0"
                },
                {
                    "fixed":  "3.1.2"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:ftp-srv_project:ftp-srv:*:*:*:*:*:node.js:*:*",
            "range":  [
                {
                    "introduced":  "4.0.0"
                },
                {
                    "fixed":  "4.3.4"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Affected versions

v1.*
v1.1.0
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.10.0
v2.10.1
v2.11.0
v2.11.1
v2.11.2
v2.11.3
v2.11.4
v2.12.0
v2.13.0
v2.13.1
v2.13.2
v2.13.3
v2.14.0
v2.15.0
v2.16.0
v2.16.1
v2.16.2
v2.17.0
v2.18.0
v2.19.0
v2.19.1
v2.19.2
v2.19.3
v2.19.4
v2.19.5
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.4.0
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v2.7.3
v2.8.0
v2.9.0
v2.9.1
v2.9.2
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.1.0
v3.1.1
v4.*
v4.0.0
v4.0.1
v4.1.0
v4.1.1
v4.2.0
v4.3.0
v4.3.1
v4.3.2
v4.3.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15152.json"

Git / github.com/quorumdms/ftp-srv

Affected ranges

Type
GIT
Repo
https://github.com/quorumdms/ftp-srv
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e449e75219d918c400dec65b4b0759f60476abca
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "fixed":  "e449e75219d918c400dec65b4b0759f60476abca"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v1.*
v1.1.0
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.10.0
v2.10.1
v2.11.0
v2.11.1
v2.11.2
v2.11.3
v2.11.4
v2.12.0
v2.13.0
v2.13.1
v2.13.2
v2.13.3
v2.14.0
v2.15.0
v2.16.0
v2.16.1
v2.16.2
v2.17.0
v2.18.0
v2.19.0
v2.19.1
v2.19.2
v2.19.3
v2.19.4
v2.19.5
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.4.0
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v2.7.3
v2.8.0
v2.9.0
v2.9.1
v2.9.2
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.1.0
v3.1.1
v4.*
v4.0.0
v4.0.1
v4.1.0
v4.1.1
v4.2.0
v4.3.0
v4.3.1
v4.3.2
v4.3.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15152.json"