PT-2010-1251 · Python · Pyftpdlib

Publicado 2010-10-19 · Atualizado 2022-05-17 · CVE-2008-7262

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions pyftpdlib versions prior to 0.3.0

Description The issue allows remote authenticated users to access arbitrary files and directories due to multiple directory traversal vulnerabilities in FTPServer.py. This can be achieved via vectors involving a symlink in a pathname to a CWD, DELE, STOR, or RETR command.

Recommendations For versions prior to 0.3.0, update to version 0.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the FTP server until the update is applied.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-7262

GHSA-JW88-WXV5-7C4F

PYSEC-2010-4

Produtos afetados

Pyftpdlib

Referências · 9

• https://github.com/giampaolo/pyftpdlib/issues/55 · Nota
• https://github.com/giampaolo/pyftpdlib · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/pyftpdlib/PYSEC-2010-4.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-7262 · Nota de Segurança
• http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY · Nota
• https://github.com/advisories/GHSA-jw88-wxv5-7c4f · Nota
• http://code.google.com/p/pyftpdlib/issues/detail?id=55 · Nota
• https://osv.dev/vulnerability/PYSEC-2010-4 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-jw88-wxv5-7c4f · Aviso do Fabricante