CVE-2009-5012

Published: Oct 19, 2010Modified: Apr 29, 2026

4.0

Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability: 8.0 / Impact: 2.9

Source: NVD

Description

ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session.

Affected (7)

Products: G.rodola: Pyftpdlib

1 product

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
G.rodola Pyftpdlib	Up to 0.5.1
G.rodola Pyftpdlib	Version 0.1.1
G.rodola Pyftpdlib	Version 0.1
G.rodola Pyftpdlib	Version 0.2.0
G.rodola Pyftpdlib	Version 0.3.0
G.rodola Pyftpdlib	Version 0.4.0
G.rodola Pyftpdlib	Version 0.5.0

Related CWEs

References (8)

http://code.google.com/p/pyftpdlib/issues/detail?id=114

Source: cve@mitre.org

http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY

Source: cve@mitre.org

http://code.google.com/p/pyftpdlib/source/detail?r=596

Source: cve@mitre.org

http://code.google.com/p/pyftpdlib/source/diff?spec=svn596&r=596&format=side&path=/trunk/pyftpdlib/ftpserver.py

Source: cve@mitre.org

http://code.google.com/p/pyftpdlib/issues/detail?id=114

Source: af854a3a-2127-422b-91ae-364da2661108

http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY

Source: af854a3a-2127-422b-91ae-364da2661108

http://code.google.com/p/pyftpdlib/source/detail?r=596

Source: af854a3a-2127-422b-91ae-364da2661108

http://code.google.com/p/pyftpdlib/source/diff?spec=svn596&r=596&format=side&path=/trunk/pyftpdlib/ftpserver.py

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.