« Volver al listado

CVE-2009-5012

Estado: ModificadaMedia (4)—

ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

G.rodola — Pyftpdlib

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-5012",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-10-19T20:00:03.050",
  "references": [
    {
      "url": "http://code.google.com/p/pyftpdlib/issues/detail?id=114",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://code.google.com/p/pyftpdlib/source/detail?r=596",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://code.google.com/p/pyftpdlib/source/diff?spec=svn596&r=596&format=side&path=/trunk/pyftpdlib/ftpserver.py",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://code.google.com/p/pyftpdlib/issues/detail?id=114",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://code.google.com/p/pyftpdlib/source/detail?r=596",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://code.google.com/p/pyftpdlib/source/diff?spec=svn596&r=596&format=side&path=/trunk/pyftpdlib/ftpserver.py",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session."
    },
    {
      "lang": "es",
      "value": "ftpserver.py en pyftpdlib anterior a v0.5.2 no necesita permisos para el comando MLST, que permite a usuarios autenticados remotamente evitar restricciones de acceso intencionadas y listar el contenido del directorio root a través de una sesión FTP."
    }
  ],
  "lastModified": "2026-06-16T23:14:49.543",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:g.rodola:pyftpdlib:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "024B769C-54ED-4228-8CE8-4DABCDCF4171",
              "versionEndIncluding": "0.5.1"
            },
            {
              "criteria": "cpe:2.3:a:g.rodola:pyftpdlib:0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB3D49FE-C51B-49E8-895E-AD4C4E138425"
            },
            {
              "criteria": "cpe:2.3:a:g.rodola:pyftpdlib:0.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2B112CF-87F7-4A6A-9D75-AD6A577FB979"
            },
            {
              "criteria": "cpe:2.3:a:g.rodola:pyftpdlib:0.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "73F985FF-9073-42E5-8651-7A440C1453E2"
            },
            {
              "criteria": "cpe:2.3:a:g.rodola:pyftpdlib:0.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA58DF28-E4B7-4BD6-B77C-56521DE0CE4F"
            },
            {
              "criteria": "cpe:2.3:a:g.rodola:pyftpdlib:0.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63AAA8E0-D608-45CD-B46C-C8936607E525"
            },
            {
              "criteria": "cpe:2.3:a:g.rodola:pyftpdlib:0.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C18591C-4D31-476F-BBC9-065E4C1A207D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}