Metraipolis › archive › dc_fe2cbc504e4a

KEV CVE-2015-3306: ProFTPD ProFTPD — ProFTPD Improper Access Control Vulnerability

Source: CISA KEV
Original: https://nvd.nist.gov/vuln/detail/CVE-2015-3306
License (as archived): CC0-1.0
Archived: 2026-10-17T15:29:51.824Z
SHA-256 of the archived text: 9a6da7345db2f47e50f58fe9915a39bd3e3a508e941c9dff7e1f01b94a3c3b1b
Stable URL of this page: https://metraipolis.com/documento/dc_fe2cbc504e4a

How to cite

KEV CVE-2015-3306: ProFTPD ProFTPD — ProFTPD Improper Access Control Vulnerability — CISA KEV, https://nvd.nist.gov/vuln/detail/CVE-2015-3306 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_fe2cbc504e4a (Metraipolis archive dc_fe2cbc504e4a, sha256 9a6da7345db2f47e50f58fe9915a39bd3e3a508e941c9dff7e1f01b94a3c3b1b)

BibTeX

@misc{dcfe2cbc504e4a,
  title = {KEV CVE-2015-3306: ProFTPD ProFTPD — ProFTPD Improper Access Control Vulnerability},
  howpublished = {CISA KEV},
  url = {https://nvd.nist.gov/vuln/detail/CVE-2015-3306},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_fe2cbc504e4a; sha256 9a6da7345db2f47e50f58fe9915a39bd3e3a508e941c9dff7e1f01b94a3c3b1b},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: CISA KEV, https://nvd.nist.gov/vuln/detail/CVE-2015-3306. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

CVE-2015-3306 è nel catalogo CISA delle vulnerabilità SFRUTTATE attivamente (Known Exploited Vulnerabilities), aggiunta il 2026-10-08.
Prodotto: ProFTPD ProFTPD — ProFTPD Improper Access Control Vulnerability
Descrizione: ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Azione richiesta (agenzie federali USA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Scadenza: 2026-10-11.
Uso noto in campagne ransomware: Unknown
Debolezze: CWE-284
Note e riferimenti: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: http://www.proftpd.org/ ; https://lists.debian.org/debian-security-announce/2015/msg00154.html ; https://lists.opensuse.org/archives/list/[contatto omesso]/message/WE6YZRG5UVXMGQ7IVDRYBPIWV4M6UUGM/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2015-3306

Fonte: catalogo CISA KEV (CC0 1.0), versione 2026.10.16, consultato il 2026-10-17: https://www.cisa.gov/known-exploited-vulnerabilities-catalog