CVE-2015-3306KEV · OVERDUECWE-284broken-access-control

ProFTPD Improper Access Control Vulnerability

Critical · published May 18, 2015

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 10.0. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.

11
days past CISA
deadline
CVSS v3.1
10.0
EPSS
99%
Percentile
99.9
In the wild
Confirmed
What it is

⚠️ A crafty use of the site cpfr and site cpto commands can let attackers read and write to any file on your ProFTPD server! 😱 Think of it like a restaurant where a diner can secretly change the ingredients of any dish on the menu without anyone noticing — they could be adding allergens or swapping flavors entirely! 🍽️ This sneaky exploit could lead to unauthorized access, allowing attackers to modify or steal critical data from your system. Imagine the chaos if someone were to change your secret recipes or even worse, delete essential files!

Put simply

Think of it like a restaurant where a diner can secretly change the ingredients of any dish on the menu without anyone noticing — they could be adding allergens or swapping flavors entirely! 🍽️ The mod_copy module in ProFTPD 1.3.5 allows attackers to leverage the powerful site cpfr and site cpto commands, enabling them to read and write arbitrary files without proper authorization.

What to do

This sneaky exploit could lead to unauthorized access, allowing attackers to modify or steal critical data from your system. Imagine the chaos if someone were to change your secret recipes or even worse, delete essential files! Upgrade your ProFTPD to version 1.3.6 or later to close this loophole. It's also wise to review your server configurations and restrict these commands where possible. Don't forget to monitor your server logs for any unusual activities! You can tackle this! With a few updates and checks, you’ll keep your server secure and running smoothly. 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.99497 · 99.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2015-05-18T19:59Z
KEV added
2026-10-08 · due 2026-10-11
Affected products (10)
ProductVersionsFixed in
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
opensuse/tumbleweedall versions—
suse/linux_enterprise_serverall versions—
suse/linux_enterprise_serverall versions—
proftpd/proftpdall versions—
References (29)
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html · [email protected]http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html · [email protected]http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html · [email protected]http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html · [email protected]http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html · [email protected]http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html · [email protected]http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html · [email protected]http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html · [email protected]http://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html · [email protected]http://www.debian.org/security/2015/dsa-3263 · [email protected]http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec · [email protected]http://www.securityfocus.com/bid/74238 · [email protected]https://www.exploit-db.com/exploits/36742/ · [email protected]https://www.exploit-db.com/exploits/36803/ · [email protected]http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html · af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html · af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html · af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html · af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html · af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html · af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html · af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html · af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2015/dsa-3263 · af854a3a-2127-422b-91ae-364da2661108http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/74238 · af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/36742/ · af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/36803/ · af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3306 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 08 OCT 00:00Z
    Added to CISA KEV — remediate by Oct 11
    kev
  • 18 MAY 15:00Z
    The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands
    cvelistv5