GitHub Advisoryadvisory · PyPI
GHSA-f8wg-36r9-7f4q Directory Traversal in pyftpdlib
MEDIUM
Official page ↗
- Aliases
- CVE-2007-6736
- Ecosystem
- PyPI
- Packages
- pyftpdlib
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-22
- Reviewed
- 2022-06-08
Affected packages
• PyPI pyftpdlib: < 0.2.0 → fixed in 0.2.0
Description
Python FTP server library provides a high-level portable interface to easily write very efficient, scalable and asynchronous FTP servers with Python. Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.2.0 allow remote authenticated users to access arbitrary files and directories via a .. (dot dot) in a (1) LIST, (2) STOR, or (3) RETR command.
Related
Alias · CVE (1)
- CVE-2007-6736 Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.2.0 allow remote authenticated users to access arbitrary… vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2007-6736 advisory
- https://github.com/giampaolo/pyftpdlib/issues/9 web
- https://github.com/advisories/GHSA-f8wg-36r9-7f4q advisory
- https://github.com/giampaolo/pyftpdlib package
- https://github.com/pypa/advisory-database/tree/main/vulns/pyftpdlib/PYSEC-2010-20.yaml web
- http://code.google.com/p/pyftpdlib/issues/detail?id=9 web
- http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY web
- http://code.google.com/p/pyftpdlib/source/detail?r=16 web
- http://code.google.com/p/pyftpdlib/source/diff?spec=svn16&r=16&format=side&path=/trunk/pyftpdlib/FTPServer.py web