GitStock

giampaolo/pyftpdlib · Security

Directory Traversal in pyftpdlib

GHSA ID
GHSA-f8wg-36r9-7f4q
CVE ID
CVE-2007-6736
Severity
medium
Published
Updated
CVSS
6.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v3
6.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Description

Python FTP server library provides a high-level portable interface to easily write very efficient, scalable and asynchronous FTP servers with Python. Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.2.0 allow remote authenticated users to access arbitrary files and directories via a .. (dot dot) in a (1) LIST, (2) STOR, or (3) RETR command.

CWEs

  • CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

References