critical9.8
CVE-2020-14056
Monsta FTP 2.10.1 or below is prone to a server-side request forgery vulnerability due to insufficient restriction of the web fetch functionality.
Impact
Monsta FTP 2.10.1 or below is prone to a server-side request forgery vulnerability due to insufficient restriction of the web fetch functionality. This allows attackers to read arbitrary local files and interact with arbitrary third-party services.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Monstaftp | Monsta Ftp | through 2.10.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20191203-02_Monsta_FTP_Server-Side_Request_Forgery
- https://www.monstaftp.com/notes/
- https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20191203-02_Monsta_FTP_Server-Side_Request_Forgery
- https://www.monstaftp.com/notes/