While this vulnerability is entirely configuration dependent. The required configuration is rather common. Exploit information here. Anonymous users or users with valid ftp access only accounts may also execute arbitrary code. Exploit information included.
Example attack transcript against glftpd.
This attack was performed against a default install with a single user account added. Anyone can execute any command on the remote system with the priveleges of the web server. Exploit description included. Anyone can execute any command on the remote system with the priveleges of the web server, and read any file on the remote system. Remote users can execute arbitrary commands on the web server with the priviledge level of the httpd process.