CVE-2021-30047: 
vsftpd vulnerability analysis and mitigation

VSFTPD 3.0.3 is affected by a denial of service vulnerability due to limitations in the number of connections allowed. The vulnerability was discovered in 2021 and assigned CVE-2021-30047. The issue affects version 3.0.3 of the VSFTPD (Very Secure FTP Daemon) software (CVE Details).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability can be exploited remotely and requires no privileges or user interaction. The attack impacts only the availability of the system, with no effect on confidentiality or integrity (NVD).

When exploited, this vulnerability allows attackers to cause a denial of service condition by exhausting the limited number of allowed connections to the FTP server. This can prevent legitimate users from accessing the FTP service (Exploit DB).

A public proof-of-concept exploit exists that demonstrates how the vulnerability can be exploited by repeatedly making new connections to the server to block legitimate users from connecting. The exploit can be enhanced by using multiple proxies if connections per IP are limited (Exploit DB).

Some security teams have questioned the validity of this CVE assignment. For instance, Ubuntu's security team has marked this as "not-affected" and noted that "this CVE assignment makes no sense" (Ubuntu).