Threats tagged 'ghsa-9f6m-7pvr-9832'

vsftpd versions through 3.0.5 have an access control bypass vulnerability that allows authenticated FTP users to execute commands that should be denied. This occurs because the process_post_login() function's cmds_denied check compares literal tokens and does not properly handle RFC 775 X-prefixed aliases. Attackers can exploit this by sending commands such as XRMD, XMKD, XCWD, XPWD, or XCUP to perform restricted operations like deleting directories.