CVE-2023-45198: 
Homebrew vulnerability analysis and mitigation

CVE-2023-45198 affects ftpd before 'NetBSD-ftpd 20230930' and tnftpd (the portable version of NetBSD ftpd) before 20231001. The vulnerability allows information disclosure about the host filesystem before authentication through MLSD or MLST commands (NVD).

The vulnerability stems from missing authentication checks in the MLST and MLSD command handlers in the FTP server. The flaw exists in the ftpcmd.y file where these commands could be executed without proper authentication verification. The severity is rated as HIGH with a CVSS v3.1 base score of 7.5 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) (NVD).

The vulnerability allows unauthenticated attackers to obtain information about the host filesystem through MLSD or MLST commands. This information disclosure could potentially be used for reconnaissance purposes or to gather sensitive information about the system's file structure (NVD).

The vulnerability has been patched in NetBSD-ftpd version 20230930 and tnftpd version 20231001. The fix involves adding proper authentication checks (check_login) for MLST and MLSD commands in the ftpcmd.y file (NetBSD Patch, NetBSD Advisory).