CVE-2015-3306
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
ProFTPD's mod_copy module allows attackers to read and write any file on the server using FTP commands, giving them complete control over files.
The mod_copy module in ProFTPD 1.3.5 fails to properly validate the SITE CPFR and SITE CPTO commands, enabling unauthenticated or low-privileged remote attackers to perform arbitrary file read/write operations. This results in complete file system compromise without requiring authentication bypass.