PyPI: pyftpdlib
CVE-2009-5012
Safety vulnerability ID: SFTY-20101019-67294
Safety legacy ID: pyup.io-54046
ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session.
Overview
Improper Access Control in pyftpdlib
Advisory
ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20101019-67294/CVE-2009-5012
- https://nvd.nist.gov/vuln/detail/CVE-2009-5012
- http://code.google.com/p/pyftpdlib/issues/detail?id=114
- https://github.com/pypa/advisory-database/tree/main/vulns/pyftpdlib/PYSEC-2010-9.yaml
- http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY
- http://code.google.com/p/pyftpdlib/source/detail?r=596
- http://code.google.com/p/pyftpdlib/source/diff?spec=svn596&r=596&format=side&path=/trunk/pyftpdlib/ftpserver.py
- https://github.com/advisories/GHSA-h4g7-8m7r-87r9
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more