CVE-2009-5012

Description

ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session.

Risk Information

Base Score

8.6

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C

EPSS Score

Exploitation Probability

0.199

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2009-5011,CVE-2009-5012,CVE-2009-5013,CVE-2010-3494 are fixed in Python-pyftpdlib 0.5.2	Windows
Vulnerabilities CVE-2009-5011,CVE-2009-5012,CVE-2009-5013,CVE-2010-3494 are fixed in Python-pyftpdlib for linux 0.5.2	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234