CVE-2008-7263
Improper Authentication in pyftpdlib
CVE-2008-7263 is a high vulnerability (CVSS 7.5) in G.rodola Pyftpdlib, published October 19, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.53%, the 75th percentile. Fixed in pyftpdlib 0.5.0.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 1.53%EPSS, 75th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.5.0pyftpdlib +1 more
Description
ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.
Exploit likelihood
Affected products
Affected packages
What each source reports
NVD Score used
ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.
- Record
CVE-2008-7263- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE ListNo score
ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.
- Record
CVE-2008-7263- Updated
- 2026-11-02
EUVDEUVD-2010-0023No score
ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.
- Record
EUVD-2010-0023- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q6w2-jxcm-2crj
Improper Authentication in pyftpdlib
ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.
- Record
GHSA-q6w2-jxcm-2crj- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVGHSA-q6w2-jxcm-2crj
Improper Authentication in pyftpdlib
ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.
- Record
GHSA-q6w2-jxcm-2crj- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVPYSEC-2010-5No score
ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.
- Record
PYSEC-2010-5- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
code.google.com/p/pyftpdlib/source/diff?spec=svn348&r=348&format=side&path=/trunk/pyftpdlib/ftpserver.py
nvd.nist.gov/vuln/detail/CVE-2008-7263
github.com/giampaolo/pyftpdlib/issues/73