In default configuration, proftpd authenticates against PAM using the "proftpd" config. This config basically includes the "password-auth" rules, which contain `auth sufficient pam_unix.so nullok try_first_pass` Thus, users with a deleted password can authenticate via FTP by providing nothing or a random string as a password - you can type whatever you want as a password, it will get accepted and you will be logged in with the identity of the existing user name you provided.
External References: https://bugzilla.redhat.com/show_bug.cgi?id=1952104
Created proftpd tracking bugs for this issue: Affects: epel-all [bug 1952170] Affects: fedora-all [bug 1952169]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.