CVE-2010-2073 auth_db_config.py in Pyftpd 0.8.4 contains hard-coded usernames and passwords for the (1) test, (2) user, and (3) roxon accounts, which allows remote attackers to read arbitrary files from the FTP ser...
HighCVSS 7.5
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
auth_db_config.py in Pyftpd 0.8.4 contains hard-coded usernames and passwords for the (1) test, (2) user, and (3) roxon accounts, which allows remote attackers to read arbitrary files from the FTP server.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/pyftpd(Debian:10) | < 0.8.5 | 0.8.5 |
| debian/pyftpd | = 0.8.4 | No fix listed |
References
- 40839 broken-link third-party-advisory vdb-entry
- pyftpd-default-account(59431) third-party-advisory vdb-entry
- bugs.debian.org mailing-list patch
- [oss-security] 20100613 CVE request - pyftpd default username and password vulnerability mailing-list technical-description