Vulnerability in Proftpd
CVE-2015-3306
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.995 (99.9th percentile), scored .
Very high probability of exploitation in the next 30 days — among the top 0.1% most-likely-to-be-exploited CVEs. 100th percentile — 99.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.968 · newest: 0.995 · change: +0.027
Affected products
- Proftpd — versions 1.3.5
- Debian Linux — versions 7.0, 8.0, 9.0
- Fedoraproject Fedora — versions 20, 21, 22
- openSUSE Tumbleweed
- SUSE Linux Enterprise Server — versions 15
Weakness classification (CWE)
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Public proof-of-concept exploits
- t0kx/exploit-CVE-2015-3306
- nootropics/propane
- bcononugbor-source/OpenVAS-Vulnerability-Analysis-Incident-Response-Report
- cybersensei-EH/hackviser_labs_CVE-2015-3306
- jptr218/proftpd_bypass
- 0xm4ud/ProFTPD_CVE-2015-3306
- cd6629/CVE-2015-3306-Python-PoC
- davidtavarez/CVE-2015-3306
- xyk0x/cpx_proftpd
- diegslva/cve-2015-3306-lab
References
- www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec (Third Party Advisory)
- www.exploit-db.com/exploits/36803/ (Exploit, exploit)
- packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html (VDB Entry, Third Party Advisory)
- www.debian.org/security/2015/dsa-3263 (vendor-advisory, Mailing List, Third Party Advisory)
- packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html (Exploit, VDB Entry)
- packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.h… (Exploit, VDB Entry)
- lists.opensuse.org/opensuse-updates/2015-06/msg00020.html (vendor-advisory, Mailing List, Third Party Advisory)
- lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html (vendor-advisory, Mailing List, Third Party Advisory, Broken Link)
- lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html (vendor-advisory, Mailing List, Third Party Advisory, Broken Link)
- www.securityfocus.com/bid/74238 (Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2015-3306?
- CVE-2015-3306 is a critical-severity vulnerability in Proftpd, classified under Improper Access Control. CVSS score: 10.0/10. Published 2015-05-18.
- How severe is CVE-2015-3306?
- Critical severity. CVSS v3 base score is 10.0 out of 10.
- Is CVE-2015-3306 known to be exploited?
- Yes. CVE-2015-3306 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-10-08), indicating it is being actively exploited. 85 public proof-of-concept repositories are indexed.