Server-side Request Forgery (SSRF) Affecting ftp-srv package, versions >=1.0.0 <4.3.4
Threat Intelligence
EPSS
0.32% (72nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-FTPSRV-598863
- published 19 Aug 2020
- disclosed 17 Aug 2020
- credit andreeleuterio
Introduced: 17 Aug 2020
CVE-2020-15152 Open this link in a new tabHow to fix?
Upgrade ftp-srv to version 4.3.4 or higher.
Overview
ftp-srv is a Modern, extensible FTP Server
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF). The client can send an arbitrary IP with the PORT command, which can be used to cause the server to make a connection elsewhere.
References
CVSS Scores
version 3.1