« Volver al listado

CVE-2007-6738

Estado: ModificadaMedia (5)—

pyftpdlib before 0.1.1 does not choose a random value for the port associated with the PASV command, which makes it easier for remote attackers to obtain potentially sensitive information about the number of in-progress data connections by reading the response to this command.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

G.rodola — Pyftpdlib

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-6738",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-10-19T20:00:01.923",
  "references": [
    {
      "url": "http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "pyftpdlib before 0.1.1 does not choose a random value for the port associated with the PASV command, which makes it easier for remote attackers to obtain potentially sensitive information about the number of in-progress data connections by reading the response to this command."
    },
    {
      "lang": "es",
      "value": "pyftpdlib anterior a v0.1.1 no elige un valor aleatorio para el puerto asociado con el comando PASV, lo que hace que sea más fácil para atacantes remotos obtener información sensible sobre el número de conexiones en curso de datos mediante la lectura de la respuesta a este comando."
    }
  ],
  "lastModified": "2026-06-16T22:48:40.713",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:g.rodola:pyftpdlib:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FEEB68EB-94B6-48DE-80DD-D68AA801E54C",
              "versionEndIncluding": "0.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}