{"cve":"CVE-2007-6741","nvd":{"published":"2010-10-19T20:00:02.580","modified":"2026-06-16T22:48:41.037","status":"Modified","description":"The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP address matches the source IP address of the connection from the FTP client, which might allow remote authenticated users to conduct FTP bounce attacks via crafted FTP data, as demonstrated by an FTP bounce attack against a NAT server, a related issue to CVE-1999-0017.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-264"],"references":["http://code.google.com/p/pyftpdlib/issues/detail?id=11","http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY","http://code.google.com/p/pyftpdlib/source/detail?r=32","http://code.google.com/p/pyftpdlib/source/diff?spec=svn32&r=32&format=side&path=/trunk/pyftpdlib/FTPServer.py","http://code.google.com/p/pyftpdlib/issues/detail?id=11"],"products":["g.rodola:pyftpdlib"],"source":"nvd","synced_at":"2026-10-19T19:57:56.749847046+00:00"},"epss":{"cve":"CVE-2007-6741","score":0.0175,"percentile":0.77872,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-8xgx-75qw-6268","url":"https://osv.dev/vulnerability/GHSA-8xgx-75qw-6268","summary":"Improper privilege management in pyftpdlib","modified":"2024-10-14T16:50:45Z","packages":[{"ecosystem":"PyPI","name":"pyftpdlib","purl":"pkg:pypi/pyftpdlib","ranges":["<0.2.0"],"fixed":["0.2.0"]}]},{"id":"PYSEC-2010-25","url":"https://osv.dev/vulnerability/PYSEC-2010-25","summary":"","modified":"2023-11-08T03:56:50.024917Z","packages":[{"ecosystem":"PyPI","name":"pyftpdlib","purl":"pkg:pypi/pyftpdlib","ranges":["<0.2.0"],"fixed":["0.2.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}