CVE-2020-15152

CRITICAL Year: 2020
CVSS v3 Score
9.1
Critical
CVSS v2 Score
5.0
Medium
Weakness Type
CWE-918
View all →

Vulnerability Description

ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.19.6, 3.1.2, and 4.3.4 are vulnerable to Server-Side Request Forgery. The PORT command allows arbitrary IPs which can be used to cause the server to make a connection elsewhere. A possible workaround is blocking the PORT through the configuration. This issue is fixed in version2 2.19.6, 3.1.2, and 4.3.4. More information can be found on the linked advisory.

Related Vulnerabilities

CVE-2017-14611

CRITICAL
CVSS:9.1(Critical)

SSRF (Server Side Request Forgery) in Cockpit 0.13.0 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter, related to use of the discontinued ahe...

CWE-9182017

CVE-2018-1000138

CRITICAL
CVSS:9.1(Critical)

I, Librarian version 4.8 and earlier contains a SSRF vulnerability in "url" parameter of getFromWeb in functions.php that can result in the attacker abusing functionality on the server to read or upda...

CWE-9182018

CVE-2018-16444

CRITICAL
CVSS:9.1(Critical)

An issue was discovered in SeaCMS 6.61. adm1n/admin_reslib.php has SSRF via the url parameter.

CWE-9182018

CVE-2018-19601

CRITICAL
CVSS:9.1(Critical)

Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.

CWE-9182018

CVE-2018-9302

CRITICAL
CVSS:9.1(Critical)

SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter....

CWE-9182018

CVE-2019-12994

CRITICAL
CVSS:9.1(Critical)

Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL.

CWE-9182019