Описание
Improper Access Control in pyftpdlib
ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2009-5012
- https://github.com/pypa/advisory-database/tree/main/vulns/pyftpdlib/PYSEC-2010-9.yaml
- http://code.google.com/p/pyftpdlib/issues/detail?id=114
- http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY
- http://code.google.com/p/pyftpdlib/source/detail?r=596
- http://code.google.com/p/pyftpdlib/source/diff?spec=svn596&r=596&format=side&path=/trunk/pyftpdlib/ftpserver.py
Пакеты
Наименование
pyftpdlib
pip
Затронутые версииВерсия исправления
<= 0.5.1
0.5.2
Связанные уязвимости
nvd
больше 15 лет назад
ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session.
debian
больше 15 лет назад
ftpserver.py in pyftpdlib before 0.5.2 does not require the l permissi ...