Vulnerability in Proftpd
CVE-2015-3306
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
EPSS: 0.937 (99.9th percentile) — read the EPSS interpretation.
Affected products
- Proftpd — versions 1.3.5
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
- t0kx/exploit-CVE-2015-3306
- nootropics/propane
- cybersensei-EH/hackviser_labs_CVE-2015-3306
- jptr218/proftpd_bypass
- 0xm4ud/ProFTPD_CVE-2015-3306
- cd6629/CVE-2015-3306-Python-PoC
- davidtavarez/CVE-2015-3306
- xyk0x/cpx_proftpd
- bcononugbor-source/OpenVAS-Vulnerability-Analysis-Incident-Response-Report
- canpilayda/proftpd-mod_copy-cve-2015-3306
References
- cve@mitre.org (x_refsource_MISC)
- 36803 (Exploit, exploit, x_refsource_EXPLOIT-DB)
- cve@mitre.org (x_refsource_MISC)
- DSA-3263 (vendor-advisory, x_refsource_DEBIAN)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_MISC)
- openSUSE-SU-2015:1031 (vendor-advisory, x_refsource_SUSE)
- FEDORA-2015-7164 (x_refsource_FEDORA, vendor-advisory)
- FEDORA-2015-6401 (x_refsource_FEDORA, vendor-advisory)
- 74238 (vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2015-3306?
- CVE-2015-3306 is a vulnerability in Proftpd, classified under Improper Access Control. Published 2015-05-18.
- Is CVE-2015-3306 known to be exploited?
- 84 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.