Source: cisa.gov
CVE-2015-3306 is an improper access control vulnerability in ProFTPD, an open-source FTP server. Remote attackers can exploit this flaw using the SITE CPFR and SITE CPTO commands to read and write arbitrary files on the affected system. This vulnerability poses a significant risk as it allows unauthorized file manipulation without proper authentication controls. It affects ProFTPD and potentially any product or system that incorporates it as a component or dependency. The vulnerability has been acknowledged by CISA and is listed under BOD 26-04 for prioritized security updates. Debian and OpenSUSE have both issued security advisories addressing this issue. Organizations using ProFTPD are strongly advised to apply available patches immediately to mitigate the risk of exploitation.
