GHSA-h4g7-8m7r-87r9

Improper Access Control in pyftpdlib

Source: GitHub Advisory Database (reviewed) High CVE-2009-5012

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pyftpdlib	< 0.5.2	0.5.2

Details

As written in the advisory (Markdown source, shown as plain text).

ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2009-5012 advisory
https://github.com/giampaolo/pyftpdlib package
https://github.com/pypa/advisory-database/tree/main/vulns/pyftpdlib/PYSEC-2010-9.yaml web
http://code.google.com/p/pyftpdlib/issues/detail?id=114 web
http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY web
http://code.google.com/p/pyftpdlib/source/detail?r=596 web
http://code.google.com/p/pyftpdlib/source/diff?spec=svn596&r=596&format=side&path=/trunk/pyftpdlib/ftpserver.py web