CVE-2015-1419
Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access...
Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.
Exploit likelihood
What each source reports
NVD Score used
Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.
- Record
CVE-2015-1419- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.
- Record
CVE-2015-1419- Updated
- 2026-11-02
EUVDEUVD-2015-1556 No score
Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.
- Record
EUVD-2015-1556- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2r24-78wj-92qx No score
Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access...
Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.
- Record
GHSA-2r24-78wj-92qx- Updated
- 2026-11-02
OSV No score
Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.
- Record
CVE-2015-1419- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-1419 No score
Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.
- Record
DEBIAN-CVE-2015-1419- Updated
- 2026-11-02
Show 6 moreShow less
OSVMGASA-2015-0103 No score
Updated vsftpd package fixes security vulnerability
The vsftp daemon was not handling the "deny_file" option properly, allowing unauthorized access in some specific scenarios (CVE-2015-1419).
- Record
MGASA-2015-0103- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10264-1 No score
vsftpd-3.0.3-7.1 on GA media
These are all security issues fixed in the vsftpd-3.0.3-7.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10264-1- Updated
- 2026-11-02
OSVSUSE-RU-2015:0952-1 No score
Recommended update for vsftpd
This update fixes regressions with using wildcards that had been introduced by the previous update (bnc#922538, bnc#927612). Additionally, stat(2) could be sometimes called on the wrong path, resulting incorrectly in ENOENT (bnc#925963).
- Record
SUSE-RU-2015:0952-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0417-1 No score
Recommended update for vsftpd
This update fixes regressions with using wildcards that had been introduced by the previous update (bnc#922538, bnc#927612). Additionally, stat(2) could be sometimes called on the wrong path, resulting incorrectly in ENOENT (bnc#925963).
- Record
SUSE-SU-2015:0417-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0516-1 No score
Security update for vsftpd
vsftpd was updated to fix one security issue.
This security issue was fixed:
- CVE-2015-1419: vsftpd config option deny_file was not handled correctly (bnc#915522).
Note: deny_file shouldn't be used to restrict access, as stated in the documentation. Please use more reliable methods.
- Record
SUSE-SU-2015:0516-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-1419 No score
Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.
- Record
UBUNTU-CVE-2015-1419- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vsftpdDebian:12 |
before 3.0.2-18 | 3.0.2-18 |
vsftpdDebian:13 |
before 3.0.2-18 | 3.0.2-18 |
vsftpdDebian:14 |
before 3.0.2-18 | 3.0.2-18 |
vsftpdMageia:4 |
before 3.0.2-4.1.mga4 | 3.0.2-4.1.mga4 |
vsftpdSUSE:Linux Enterprise Server 12 |
before 3.0.2-18.1 | 3.0.2-18.1 |
vsftpdSUSE:Linux Enterprise Server for SAP Applications 12 |
before 3.0.2-18.1 | 3.0.2-18.1 |
vsftpdUbuntu:14.04:LTS |
All versions, plus listed versions 3.0.2-1ubuntu23.0.2-1ubuntu2.14.04.1 |
None known |
vsftpdopenSUSE:Tumbleweed |
before 3.0.3-7.1 | 3.0.3-7.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | vsftpd <= 3.0.2 - Access Restriction Bypass |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-1419 is a medium vulnerability (CVSS 5.0) in Vsftpd Project Vsftpd, published January 28, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.79%, the 94th percentile. Fixed in vsftpd 3.0.2-18.
References
lists.opensuse.org/opensuse-security-announce/2015-01/msg00023.html
secunia.com/advisories/62415
nvd.nist.gov/vuln/detail/CVE-2015-1419
github.com/advisories/GHSA-2r24-78wj-92qx
security-tracker.debian.org/tracker/CVE-2015-1419
Show 15 moreShow less
advisories.mageia.org/MGASA-2015-0103.html
bugs.mageia.org/show_bug.cgi?id=15436
suse.com/support/update/announcement//suse-ru-20150952-1
bugzilla.suse.com/900326
ubuntu.com/security/CVE-2015-1419
seclists.org/oss-sec/2015/q1/389
cve.org/CVERecord?id=CVE-2015-1419