ProFTPD Improper Access Control
CVE-2015-3306 is a high-severity improper access control vulnerability in Fedora from Fedora Project, with a CVSS 2.0 base score of 10.0 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected Fedora versions: 20; 21; 22. The record does not name a fixed version, so check the vendor advisory. CISA added it to the Known Exploited Vulnerabilities catalogue on October 8, 2026, which means attacks have been observed in the wild.
Attackers are already exploiting this vulnerability, according to CISA.
What to do
- Check which version of Fedora you run against the affected versions below, and install the vendor's latest release.
- CISA's required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Fedora Project | Fedora | 20; 21; 22 | Not stated |
| Debian | Debian Linux | 7.0; 8.0; 9.0 | Not stated |
| openSUSE | Tumbleweed | Not specified in the record | Not stated |
| SUSE | Linux Enterprise Server | 15 | Not stated |
| Proftpd | Proftpd | 1.3.5 | Not stated |
Version data comes from NVD's product matching. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Access vector
- NetworkCan be exploited remotely over a network.
- Access complexity
- LowNo special conditions are needed.
- Authentication
- NoneNo login is needed.
- Confidentiality
- CompleteAll data can be read.
- Integrity
- CompleteAny data can be modified.
- Availability
- CompleteThe system can be shut down completely.
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 10.0 | Critical | CISA (ADP) |
| CVSS 2.0 | 10.0 | High | NVD |
Official description
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How developers prevent this class of flaw
- Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Timeline
- CVE record published.
- Added to CISA's Known Exploited Vulnerabilities catalogue.
- CISA published its SSVC assessment (exploitation: active, automatable: yes, technical impact: total).
- Record last changed materially (score, affected products, status or references).
- Deadline for US federal agencies to remediate, set by CISA.
References
Third-party and government advisories
- lists.opensuse.org/opensuse-updates/2015-06/msg00020.htmlMailing List, Third Party Advisory
- packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.htmlThird Party Advisory, VDB Entry
- packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.htmlThird Party Advisory, VDB Entry
- debian.org/security/2015/dsa-3263Mailing List, Third Party Advisory
- rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_execThird Party Advisory
- securityfocus.com/bid/74238Third Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3306US Government Resource
Technical write-ups (may include proof of concept)
- packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.htmlExploit, VDB Entry
- packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.htmlExploit, VDB Entry
- packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.htmlExploit, VDB Entry
- exploit-db.com/exploits/36742/Exploit
- exploit-db.com/exploits/36803/Exploit
Other vulnerabilities in Fedora
- 7.8 High severity
- 8.8 High severity
- 8.8 High severity
- 8.8 High severity
- 8.8 High severity
- 8.8 High severity
Recent Improper Access Control vulnerabilities
- 8.1 High severity
Elasticsearch Remote Code Execution Exploited
- 4.3 Medium severity
Oracle JRE Unspecified Exploited
- 10.0 High severity
Oracle JRE Remote Code Execution Exploited
- 10.0 High severity
Oracle Java SE Sandbox Bypass Exploited
- 9.8 Critical severity
- 10.0 High severity
Spotted an error? Tell us.