CVE-2019-12815

Опубликовано: 19 июл. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Высокий

Описание

An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.

Ссылки

http://bugs.proftpd.org/show_bug.cgi?id=4372
Exploit
Issue Tracking
Patch
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00004.html
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00022.html
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html
Broken Link
http://www.securityfocus.com/bid/109339
Broken Link
Third Party Advisory
VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-940889.pdf
Third Party Advisory
https://github.com/proftpd/proftpd/pull/816
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/08/msg00006.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OJDQ3XUYWO42TJBO53NUWDZRA35QMVEI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XM5FPBAGSIKV6YJZEPM6GPGJO5JFT7XU/
https://seclists.org/bugtraq/2019/Aug/3
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/201908-16
Third Party Advisory
https://tbspace.de/cve201912815proftpd.html
Patch
Third Party Advisory
https://www.debian.org/security/2019/dsa-4491
Third Party Advisory
http://bugs.proftpd.org/show_bug.cgi?id=4372
Exploit
Issue Tracking
Patch
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00004.html
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00022.html
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html
Broken Link
http://seclists.org/fulldisclosure/2024/Aug/35
http://www.securityfocus.com/bid/109339
Broken Link
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*

Версия до 1.3.5b (включая)

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 5

Одновременно

cpe:2.3:o:siemens:simatic_cp_1543-1_firmware:*:*:*:*:*:*:*:*

Версия от 2.0 (включая) до 2.2 (исключая)

cpe:2.3:h:siemens:simatic_cp_1543-1:-:*:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.78813

Высокий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-755

Связанные уязвимости

CVE-2019-12815

CVSS3: 9.8

ubuntu

больше 6 лет назад

An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.

CVE-2019-12815

CVSS3: 9.8

debian

больше 6 лет назад

An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3. ...

GHSA-f989-xw5v-4w5p

CVSS3: 9.8

github

больше 3 лет назад

An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.

BDU:2019-02747

CVSS3: 10

fstec

больше 6 лет назад

Уязвимость модуля mod_copy FTP-сервера ProFTPD, позволяющая нарушителю выполнить произвольный код в целевой системе посредством передачи команд CPFR и CPTO на сервер ProFTPD

openSUSE-SU-2019:1836-1

suse-cvrf

больше 6 лет назад

Security update for proftpd

EPSS

Процентиль: 99%

0.78813

Высокий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-755