CVE-2020-15152

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.19.6, 3.1.2, and 4.3.4 are vulnerable to Server-Side Request Forgery. The PORT command allows arbitrary IPs which can be used to cause the server to make a connection elsewhere. A possible workaround is blocking the PORT through the configuration. This issue is fixed in version2 2.19.6, 3.1.2, and 4.3.4. More information can be found on the linked advisory.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Aug 17, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-151539.8Ampache before version 4.2.2 allows unauthenticated users to perform SQL injection. Refer to the referenced GitHub Security Advisory for det CVE-2020-151547.3baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit thi CVE-2020-151557.3baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit thi CVE-2020-151568.1In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post CVE-2020-151576.1In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container ima CVE-2020-151589.8In libIEC61850 before version 1.4.3, when a message with COTP message length field with value < 4 is received an integer underflow will happ CVE-2020-151597.6baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as CVE-2020-15167.8An elevation of privilege vulnerability exists when the Windows Work Folders Service improperly handles memory. To exploit this vulnerabilit CVE-2020-151609.8PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page CVE-2020-151616.1In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The pro CVE-2020-151625.4In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people CVE-2020-151638.2Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metada