{"id":"CVE-2015-3306","published":"2015-05-18T15:59:10Z","modified":"2026-10-09T16:17:18Z","title":"ProFTPD Improper Access Control Vulnerability","vendor":"ProFTPD","product":"ProFTPD","tier":"core","eol":null,"description":{"text":"The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.","provenance":"source","from":"NVD"},"summary":{"text":"The mod_copy module in ProFTPD 1.3.5 contains an improper access control flaw that affects the ProFTPD FTP server. An attacker with network access can use the site cpfr and site cpto commands to read and write arbitrary files, and no authentication, user interaction, or special configuration is required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:08:00Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99497,"percentile":0.99945,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2026-10-08","dueDate":"2026-10-11","ransomware":false,"requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: http://www.proftpd.org/ ; https://lists.debian.org/debian-security-announce/2015/msg00154.html ; https://lists.opensuse.org/archives/list/updates@lists.opensuse.org/message/WE6YZRG5UVXMGQ7IVDRYBPIWV4M6UUGM/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2015-3306","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-10-08","exploitedFirstSeen":"2026-10-08","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a","date":"2026-10-08"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-10-08"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":23,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html","tags":["Broken Link","Mailing List","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html","tags":["Broken Link","Mailing List","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html","tags":["Broken Link","Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html","tags":["Exploit","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html","tags":["Exploit","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html","tags":["Exploit","VDB Entry"]},{"url":"http://www.debian.org/security/2015/dsa-3263","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/74238","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/36742/","tags":["Exploit"]},{"url":"https://www.exploit-db.com/exploits/36803/","tags":["Exploit"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html","tags":["Broken Link","Mailing List","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html","tags":["Broken Link","Mailing List","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html","tags":["Broken Link","Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html","tags":["Exploit","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html","tags":["Exploit","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html","tags":["Exploit","VDB Entry"]},{"url":"http://www.debian.org/security/2015/dsa-3263","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/74238","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/36742/","tags":["Exploit"]},{"url":"https://www.exploit-db.com/exploits/36803/","tags":["Exploit"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3306","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote unauthenticated exploitation of exposed FTP service","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to read and write to arbitrary files","start":37,"end":97}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary file read from local system","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote attackers to read and write to arbitrary files","start":37,"end":97}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2015-3352","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-3352","exploited":true,"exploitedSince":"2026-10-08","provenance":"source"},"exploits":[{"id":36742,"url":"https://www.exploit-db.com/exploits/36742","title":"ProFTPd 1.3.5 - File Copy","type":"remote","platform":"linux","date":"2015-04-13","verified":true,"provenance":"source"},{"id":36803,"url":"https://www.exploit-db.com/exploits/36803","title":"ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution","type":"remote","platform":"linux","date":"2015-04-21","verified":false,"provenance":"source"},{"id":37262,"url":"https://www.exploit-db.com/exploits/37262","title":"ProFTPd 1.3.5 - 'mod_copy' Command Execution (Metasploit)","type":"remote","platform":"linux","date":"2015-06-10","verified":true,"provenance":"source"},{"id":49908,"url":"https://www.exploit-db.com/exploits/49908","title":"ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2)","type":"remote","platform":"linux","date":"2021-05-26","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":4,"earliest":"2015-04-13"},"pocGithub":{"count":16,"skipped":2,"earliest":"2015-04-21","earliestUrl":"https://github.com/xyk0x/cpx_proftpd","repos":[{"name":"t0kx/exploit-CVE-2015-3306","url":"https://github.com/t0kx/exploit-CVE-2015-3306","stars":152,"created":"2017-01-08"},{"name":"nootropics/propane","url":"https://github.com/nootropics/propane","stars":2,"created":"2015-04-26"},{"name":"xyk0x/cpx_proftpd","url":"https://github.com/xyk0x/cpx_proftpd","stars":1,"created":"2015-04-21"},{"name":"davidtavarez/CVE-2015-3306","url":"https://github.com/davidtavarez/CVE-2015-3306","stars":1,"created":"2017-07-29"},{"name":"cd6629/CVE-2015-3306-Python-PoC","url":"https://github.com/cd6629/CVE-2015-3306-Python-PoC","stars":1,"created":"2020-10-16"}]},"metasploit":[{"name":"ProFTPD 1.3.5 Mod_Copy Command Execution","module":"exploit/unix/ftp/proftpd_modcopy_exec","type":"exploit","disclosureDate":"2015-04-22","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/ftp/proftpd_modcopy_exec.rb"}],"nuclei":[{"id":"CVE-2015-3306","name":"ProFTPd - Remote Code Execution","severity":"critical","path":"network/cves/2015/CVE-2015-3306.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2015/CVE-2015-3306.yaml"}],"first":{"date":"2015-04-13","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/36742"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html","http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html","http://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html","https://www.exploit-db.com/exploits/36742/","https://www.exploit-db.com/exploits/36803/","http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html","http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2015-04-13","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-36742); later: PoC-in-GitHub 2015-04-21, Metasploit 2015-04-22","url":"https://www.exploit-db.com/exploits/36742","provenance":"source"},{"date":"2015-05-18","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3306","provenance":"source"},{"date":"2026-10-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a","provenance":"source"},{"date":"2026-10-08","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-10-08","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-3352","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":4161},"priority":{"score":80.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 21 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9994"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 NVD references tagged Exploit; 4 Exploit-DB entries; 2 NVD exploit links; 16 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"23 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"children":[{"from":"CVE-2015-3306","to":"CVE-2019-12815","relation":"related","confidence":"low","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.","from":"CVE.org","in":"CVE-2019-12815"}]}]}}