{"id":"CVE-2019-12815","aliases":["DEBIAN-CVE-2019-12815","DLA-1873-1","DSA-4491-1","EUVD-2019-4396","GHSA-f989-xw5v-4w5p","MGASA-2019-0314","UBUNTU-CVE-2019-12815","openSUSE-SU-2019:1836-1","openSUSE-SU-2019:1870-1","openSUSE-SU-2020:0031-1","openSUSE-SU-2024:11196-1"],"status":"published","title":"An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code...","description":"An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.57333,"percentile":0.99082,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-755"],"published":"2019-07-19T22:56:14Z","modified":"2026-11-01T10:45:14Z","exploits":[{"source":"pocgithub","id":"KTN1990/CVE-2019-12815","title":"KTN1990/CVE-2019-12815","date":"2019-07-27","url":"https://github.com/KTN1990/CVE-2019-12815"},{"source":"pocgithub","id":"lcartey/proftpd-cve-2019-12815","title":"lcartey/proftpd-cve-2019-12815","date":"2020-08-25","url":"https://github.com/lcartey/proftpd-cve-2019-12815"}],"fixes":[{"ecosystem":"Debian:12","package":"proftpd-dfsg","fixed_in":["1.3.6-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"proftpd-dfsg","fixed_in":["1.3.6-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"proftpd-dfsg","fixed_in":["1.3.6-6"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"proftpd-dfsg","fixed_in":["1.3.5e+r1.3.5-2+deb8u3"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"proftpd-dfsg","fixed_in":["1.3.5b-4+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"proftpd-dfsg","fixed_in":["1.3.6-4+deb10u1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-6"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5e+r1.3.5-2+deb8u3"}]}],"versions":["1.3.5-1.1","1.3.5-1.1+deb8u1","1.3.5-1.1+deb8u2","1.3.5-2","1.3.5a-1","1.3.5b-1","1.3.5b-2","1.3.5b-3","1.3.5b-4","1.3.5d-1","1.3.5e+r1.3.5-2+deb8u1","1.3.5e+r1.3.5-2+deb8u2","1.3.5e-0+deb8u1","1.3.5e-1"]},{"source":"osv","ecosystem":"Debian:9","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5b-4+deb9u1"}]}],"versions":["1.3.5b-4"]},{"source":"osv","ecosystem":"Debian:10","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-4+deb10u1"}]}],"versions":["1.3.6-4"]},{"source":"osv","ecosystem":"Mageia:7","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5e-4.1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.5-2","1.3.5a-1","1.3.5a-1build1","1.3.5a-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.5d-1","1.3.5e-1build1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5e-bp150.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5e-bp150.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5e-bp150.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5e-bp151.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6b-bp151.4.6.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6b-bp151.4.6.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6b-bp151.4.6.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6e-1.10"}]}],"bundled":7}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"proftpd","product":"proftpd"},{"vendor":"siemens","product":"simatic_cp_1543-1_firmware"}],"references":[{"url":"https://tbspace.de/cve201912815proftpd.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://bugs.proftpd.org/show_bug.cgi?id=4372","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Vendor Advisory","fix","report"]},{"url":"https://github.com/proftpd/proftpd/pull/816","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"http://www.securityfocus.com/bid/109339","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XM5FPBAGSIKV6YJZEPM6GPGJO5JFT7XU/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OJDQ3XUYWO42TJBO53NUWDZRA35QMVEI/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://seclists.org/bugtraq/2019/Aug/3","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4491","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/08/msg00006.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00004.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00022.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"https://security.gentoo.org/glsa/201908-16","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-940889.pdf","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://seclists.org/fulldisclosure/2024/Aug/35","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12815"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OJDQ3XUYWO42TJBO53NUWDZRA35QMVEI"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XM5FPBAGSIKV6YJZEPM6GPGJO5JFT7XU"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OJDQ3XUYWO42TJBO53NUWDZRA35QMVEI"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XM5FPBAGSIKV6YJZEPM6GPGJO5JFT7XU"},{"url":"https://github.com/advisories/GHSA-f989-xw5v-4w5p"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-12815","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0314.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12815","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-12815","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KXPGYD3YUWLXQJZK2Q7OAYM2YSWGXNUI/#KXPGYD3YUWLXQJZK2Q7OAYM2YSWGXNUI","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1142281","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12815","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2TKHSM2I77TZO2WX6JAB2SHAW5JQZGWZ/#2TKHSM2I77TZO2WX6JAB2SHAW5JQZGWZ","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YQAELVZ2VM7ZCMMAPQ4KYBJ6KWLXIVC2/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1113041","tags":["report"]},{"url":"https://bugzilla.suse.com/1144056","tags":["report"]},{"url":"https://bugzilla.suse.com/1154600","tags":["report"]},{"url":"https://bugzilla.suse.com/1155834","tags":["report"]},{"url":"https://bugzilla.suse.com/1156210","tags":["report"]},{"url":"https://bugzilla.suse.com/1157798","tags":["report"]},{"url":"https://bugzilla.suse.com/1157803","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19270","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-5815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9273","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-12815","description":"An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.","status":"published","published":"2019-07-19T22:56:14Z","modified":"2025-11-04T16:09:12.22Z","updated_at":"2026-11-02T14:20:24.025419Z"}],"euvd":[{"id":"EUVD-2019-4396","description":"An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.","status":"published","published":"2019-07-19T22:56:14Z","modified":"2025-11-04T16:09:12Z","updated_at":"2026-11-02T19:49:29.391161Z"}],"ghsa":[{"id":"GHSA-f989-xw5v-4w5p","title":"An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code...","description":"An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.","status":"published","published":"2022-05-24T16:50:47Z","modified":"2025-11-04T18:31:37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T15:04:33.911399Z"}],"nvd":[{"id":"CVE-2019-12815","description":"An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.","status":"published","published":"2019-07-19T23:15:11.03Z","modified":"2026-06-17T02:15:32.487Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:05:20.616405Z"}],"osv":[{"id":"CVE-2019-12815","description":"An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.","status":"published","published":"2019-07-19T23:15:11.03Z","modified":"2026-11-09T10:45:06.100754506Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-09T10:53:57.550641Z"},{"id":"DEBIAN-CVE-2019-12815","description":"An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.","status":"published","published":"2019-07-19T23:15:11.03Z","modified":"2026-09-21T07:00:25.212207373Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"UBUNTU-CVE-2019-12815","description":"An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.","status":"published","published":"2019-07-19T23:15:00Z","modified":"2026-04-22T12:08:43.625518Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"DLA-1873-1","title":"proftpd-dfsg - security update","status":"published","published":"2019-08-07T00:00:00Z","modified":"2026-03-09T01:18:28.892896Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4491-1","title":"proftpd-dfsg - security update","status":"published","published":"2019-08-04T00:00:00Z","modified":"2026-03-09T02:08:45.213117Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2019-0314","title":"Updated proftpd packages fix security vulnerabilities","description":"Updated proftpd package fixes security vulnerabilities:\n\nIt was discovered that the mod_copy module of ProFTPD, a FTP/SFTP/FTPS\nserver, performed incomplete permission validation for the CPFR/CPTO\ncommands (CVE-2019-12815).\n\nIt was discovered that due to incorrect handling of overly long commands,\na remote unauthenticated user could trigger a denial-of-service by\nreaching an endless loop (CVE-2019-18217).\n","status":"published","published":"2019-11-07T23:36:48Z","modified":"2026-04-16T04:42:34.88309056Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2019:1836-1","title":"Security update for proftpd","description":"This update for proftpd fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-12815: Fixed arbitrary file copy in mod_copy that allowed for remote code execution and information disclosure without authentication (bnc#1142281).\n","status":"published","published":"2019-08-08T09:05:33Z","modified":"2026-02-04T04:35:16.466401Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1870-1","title":"Security update for proftpd","description":"This update for proftpd fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-12815: Fixed arbitrary file copy in mod_copy that allowed for remote code execution and information disclosure without authentication (bnc#1142281).\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-08-14T05:59:02Z","modified":"2026-02-04T03:19:45.71759Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2020:0031-1","title":"Security update for proftpd","description":"This update for proftpd fixes the following issues:\n\n* GeoIP has been discontinued by Maxmind (boo#1156210)\n  This update removes module build for geoip\n    see https://support.maxmind.com/geolite-legacy-discontinuation-notice/\n\n- CVE-2019-19269: Fixed a NULL pointer dereference may occur when validating the certificate of a client connecting to the server (boo#1157803)\n- CVE-2019-19270: Fixed a Failure to check for the appropriate field of a CRL entry prevents some valid CRLs from being taken into account (boo#1157798)\n- CVE-2019-18217: Fixed remote unauthenticated denial-of-service due to incorrect handling of overly long commands (boo#1154600 gh#846)\n\nUpdate to 1.3.6b\n\n* Fixed pre-authentication remote denial-of-service issue (Issue #846).\n* Backported fix for building mod_sql_mysql using MySQL 8 (Issue #824).\n\nUpdate to 1.3.6a:\n\n* Fixed symlink navigation (Bug#4332).\n* Fixed building of mod_sftp using OpenSSL 1.1.x releases (Issue#674).\n* Fixed SITE COPY honoring of \u003cLimit\u003e restrictions (Bug#4372).\n* Fixed segfault on login when using mod_sftp + mod_sftp_pam (Issue#656).\n* Fixed restarts when using mod_facl as a static module\n* Add missing Requires(pre): group(ftp) for Leap 15 and Tumbleweed (boo#1155834)\n* Add missing Requires(pre): user(ftp) for Leap 15 and Tumbleweed (boo#1155834)\n* Use pam_keyinit.so (boo#1144056)\n\n- Reduce hard dependency on systemd to only that which is\n  necessary for building and installation.\n\nupdate to 1.3.6:\n\n* Support for using Redis for caching, logging; see the doc/howto/Redis.html\n  documentation.\n* Fixed mod_sql_postgres SSL support (Issue #415).\n* Support building against LibreSSL instead of OpenSSL (Issue #361).\n* Better support on AIX for login restraictions (Bug #4285).\n* TimeoutLogin (and other timeouts) were not working properly for SFTP\n  connections (Bug#4299).\n* Handling of the SIGILL and SIGINT signals, by the daemon process, now causes\n  the child processes to be terminated as well (Issue #461).\n* RPM .spec file naming changed to conform to Fedora guidelines.\n* Fix for 'AllowChrootSymlinks off' checking each component for symlinks (CVE-2017-7418).\n\nNew Modules:\n\n* mod_redis, mod_tls_redis, mod_wrap2_redis\n    With Redis now supported as a caching mechanism, similar to Memcache,\n    there are now Redis-using modules: mod_redis (for configuring the Redis\n    connection information), mod_tls_redis (for caching SSL sessions and\n    OCSP information using Redis), and mod_wrap2_redis (for using ACLs stored\n    in Redis).\n\nChanged Modules:\n\n* mod_ban:\n      The mod_ban module's BanCache directive can now use Redis-based caching;\n      see doc/contrib/mod_ban.html#BanCache.\n\n-New Configuration Directives\n\n* SQLPasswordArgon2, SQLPasswordScrypt\n\n      The key lengths for Argon2 and Scrypt-based passwords are now configurable\n      via these new directives; previously, the key length had been hardcoded\n      to be 32 bytes, which is not interoperable with all other implementations\n      (Issue #454).\n\nChanged Configuration Directives\n\n* AllowChrootSymlinks\n    When 'AllowChrootSymlinks off' was used, only the last portion of the\n    DefaultRoot path would be checked to see if it was a symlink.  Now,\n    each component of the DefaultRoot path will be checked to see if it is\n    a symlink when 'AllowChrootSymlinks off' is used.\n* Include\n    The Include directive can now be used within a \u003cLimit\u003e section, e.g.:\n      \u003cLimit LOGIN\u003e\n          Include /path/to/allowed.txt\n          DenyAll\n        \u003c/Limit\u003e\nAPI Changes\n  * A new JSON API has been added, for use by third-party modules. \n\n","status":"published","published":"2020-01-13T15:20:23Z","modified":"2026-02-04T03:19:18.079575Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11196-1","title":"proftpd-1.3.6e-1.10 on GA media","description":"These are all security issues fixed in the proftpd-1.3.6e-1.10 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:26:25.484191Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}