Skip to content

CVE-2008-7263

Improper Authentication in pyftpdlib

7.5 HighFix available

CVE-2008-7263 is a high vulnerability (CVSS 7.5) in G.rodola Pyftpdlib, published October 19, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.53%, the 74th percentile. Fixed in pyftpdlib 0.5.0.

ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.

Exploit likelihood

1.53%Up 0.3 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.

Record: CVE-2008-7263
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-287
Updated: 2026-11-02

CVE List No score

ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.

Record: CVE-2008-7263
Updated: 2026-11-02

EUVDEUVD-2010-0023 No score

ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.

Record: EUVD-2010-0023
Updated: 2026-11-03

GitHub AdvisoriesGHSA-q6w2-jxcm-2crj 6.9

Improper Authentication in pyftpdlib

ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.

Record: GHSA-q6w2-jxcm-2crj
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-287
Updated: 2026-11-02

OSVGHSA-q6w2-jxcm-2crj 6.9

Improper Authentication in pyftpdlib

ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.

Record: GHSA-q6w2-jxcm-2crj
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-287
Updated: 2026-11-02

OSVPYSEC-2010-5 No score

ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.

Record: PYSEC-2010-5
Updated: 2026-11-02

Affected products

g.rodola pyftpdlib

Affected packages

Affected packages
Package	Affected	Fixed
`pyftpdlib` PyPI	before 0.5.0	0.5.0
`pyftpdlib` PyPI	before 0.5.0, plus listed versions 0.2.00.3.00.4.0	0.5.0

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References