CVE-2015-3306

CISA KEV

ACT NOW Priority: 0.00 BB Relevance: 0/100

Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

CISA Known Exploited Vulnerability

Vendor / Product ProFTPD — ProFTPD

Date Added 2026-10-08

Remediation Due 2026-10-11

This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: http://www.proftpd.org/ ; https://lists.debian.org/debian-security-announce/2015/msg00154.html ; https://lists.opensuse.org/archives/list/updates@lists.opensuse.org/message/WE6YZRG5UVXMGQ7IVDRYBPIWV4M6UUGM/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2015-3306

Weakness Classification (1)

CWE-284

Affected Software (10)

Vendor	Product	Version
debian	debian_linux	7.0
debian	debian_linux	8.0
debian	debian_linux	9.0
fedoraproject	fedora	20
fedoraproject	fedora	21
fedoraproject	fedora	22
opensuse	tumbleweed	-
proftpd	proftpd	1.3.5
suse	linux_enterprise_server	15
suse	linux_enterprise_server	15