PT-2010-1814 · Pyftpdlib · Pyftpdlib

Publicado 2010-10-19 · Atualizado 2022-05-02 · CVE-2009-5012

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions pyftpdlib versions prior to 0.5.2

Description The issue allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session, due to the lack of required permissions for the MLST command in ftpserver.py.

Recommendations For versions prior to 0.5.2, update to version 0.5.2 or later to resolve the issue.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

CWE-264

Identificadores relacionados

CVE-2009-5012

GHSA-H4G7-8M7R-87R9

PYSEC-2010-9

Produtos afetados

Pyftpdlib

Referências · 13

• https://github.com/giampaolo/pyftpdlib · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/pyftpdlib/PYSEC-2010-9.yaml · Nota
• http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-5012 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2010-9 · Aviso do Fabricante
• http://code.google.com/p/pyftpdlib/issues/detail?id=114 · Nota
• http://code.google.com/p/pyftpdlib/source/diff?spec=svn596&r=596&format=side&path=/trunk/pyftpdlib/ftpserver.py · Nota
• https://osv.dev/vulnerability/GHSA-h4g7-8m7r-87r9 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2009-5012 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2009-5012 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-5012 · Nota de Segurança
• http://code.google.com/p/pyftpdlib/source/detail?r=596 · Nota
• https://github.com/advisories/GHSA-h4g7-8m7r-87r9 · Nota