Unscored severity · published Apr 22, 2007
CVE-2007-2165
The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same…
–
CVSS
12.2%
EPSS
No
On KEV
Description
The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as demonstrated by use of SQLAuthTypes Plaintext in mod_sql, with data retrieved from /etc/passwd.
Exploitation
Is it being used?
Exploit prediction (EPSS)12.2% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Proftpd · Proftpd Project
through 1.3.0_rc1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-2165
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-2165
Vendor Advisory
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=419255
Patch
http://bugs.proftpd.org/show_bug.cgi?id=2922
osvdb.org
http://osvdb.org/34602
Vendor Advisory
http://secunia.com/advisories/24867
secunia.com
http://secunia.com/advisories/25724
secunia.com
http://secunia.com/advisories/27516
More from Proftpd
8.1
CVE-2026-35025
ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR
6.5
CVE-2026-53994
ProFTPD mod_sftp Heap Buffer Overflow via Unsigned Integer Underflow and Size Truncation
–
CVE-2009-0542
SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (percent) character in the username, which…
–
CVE-2008-4242
ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute…
–
CVE-2006-6563
Stack-based buffer overflow in the pr_ctrls_recv_request function in ctrls.c in the mod_ctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a…