CVE-2009-5012

Advisory

ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-h4g7-8m7r-87r9
• https://nvd.nist.gov/vuln/detail/CVE-2009-5012
• https://github.com/giampaolo/pyftpdlib
• https://github.com/pypa/advisory-database/tree/main/vulns/pyftpdlib/PYSEC-2010-9.yaml
• http://code.google.com/p/pyftpdlib/issues/detail?id=114
• http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY
• http://code.google.com/p/pyftpdlib/source/detail?r=596
• http://code.google.com/p/pyftpdlib/source/diff?spec=svn596&r=596&format=side&path=/trunk/pyftpdlib/f
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5012
• http://code.google.com/p/pyftpdlib/source/diff?spec=svn596&r=596&format=side&path=/trunk/pyftpdlib/ftpserver.py