CVE-2015-3306
CriticalProFTPD Improper Access Control Vulnerability
10.0 CVSS v3.1
- Published
- May 18, 2015
- Updated
- Oct 9, 2026
- Vendor
- Debian, Fedoraproject, Opensuse, Proftpd, Suse
- Affected versions
- See affected products
- Weakness
- CWE-284
Summary
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Severity
Critical (10.0)CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
- Fedoraproject Fedora 20
- Fedoraproject Fedora 21
- Fedoraproject Fedora 22
- Debian Debian Linux 7.0
- Debian Debian Linux 8.0
- Debian Debian Linux 9.0
- Opensuse Tumbleweed
- Suse Linux Enterprise Server 15
- Proftpd Proftpd 1.3.5
Exploitation status
Actively exploited
Listed in the CISA Known Exploited Vulnerabilities catalog on Oct 8, 2026. Federal remediation due: Oct 11, 2026.
Technical details
Technical analysis has not been written for this record yet.
Mitigation & remediation
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
References
- NVD entry
- Broken Link, Mailing List, Third Party Advisory
- Broken Link, Mailing List, Third Party Advisory
- Broken Link, Mailing List, Third Party Advisory
- Mailing List, Third Party Advisory
- Third Party Advisory, VDB Entry
- Third Party Advisory, VDB Entry
- Exploit, VDB Entry
- Exploit, VDB Entry
- Exploit, VDB Entry
- Mailing List, Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Exploit
- Exploit
- Broken Link, Mailing List, Third Party Advisory
- CISA KEV catalog