{"id":"CVE-2024-48651","aliases":["ALPINE-CVE-2024-48651","DEBIAN-CVE-2024-48651","DLA-3975-1","DSA-5827-1","EUVD-2024-43211","GHSA-mw3w-3jx9-mhff","MGASA-2025-0015","OESA-2024-2508","SUSE-SU-2025:1028-1","UBUNTU-CVE-2024-48651","USN-7297-1","openSUSE-SU-2025:14636-1"],"status":"published","title":"In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access...","description":"In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0214,"percentile":0.82195,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2024-11-29T00:00:00Z","modified":"2026-11-07T08:30:02Z","exploits":[{"source":"nuclei","id":"CVE-2024-48651","title":"ProFTPD ≤ 1.3.8b - Privilege Escalation via mod_sql","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2024/CVE-2024-48651.yaml"}],"fixes":[{"ecosystem":"Alpine:v3.20","package":"proftpd","fixed_in":["1.3.8c-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"proftpd","fixed_in":["1.3.8c-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"proftpd","fixed_in":["1.3.8c-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"proftpd","fixed_in":["1.3.8c-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"proftpd","fixed_in":["1.3.8c-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"proftpd-dfsg","fixed_in":["1.3.8+dfsg-4+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"proftpd-dfsg","fixed_in":["1.3.8.b+dfsg-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"proftpd-dfsg","fixed_in":["1.3.8.b+dfsg-4"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"proftpd","fixed_in":["1.3.8c-1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"proftpd","fixed_in":["1.3.8b-3.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"proftpd","fixed_in":["1.3.8b-5.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"proftpd","fixed_in":["1.3.8b-5.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"proftpd","fixed_in":["1.3.8b-5.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"proftpd","fixed_in":["1.3.8b-5.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"proftpd-dfsg","fixed_in":["1.3.6c-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"proftpd-dfsg","fixed_in":["1.3.7c+dfsg-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"proftpd-dfsg","fixed_in":["1.3.8.b+dfsg-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"proftpd","fixed_in":["1.3.8c-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8c-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8c-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8c-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8c-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8c-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8+dfsg-4+deb12u4"}]}],"versions":["1.3.8+dfsg-4","1.3.8+dfsg-4+deb12u1","1.3.8+dfsg-4+deb12u2","1.3.8+dfsg-4+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8.b+dfsg-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8.b+dfsg-4"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.7a+dfsg-12+deb11u3"}]}],"versions":["1.3.7a+dfsg-12","1.3.7a+dfsg-12+deb11u1","1.3.7a+dfsg-12+deb11u2"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8+dfsg-4+deb12u4"}]}],"versions":["1.3.8+dfsg-4","1.3.8+dfsg-4+deb12u1","1.3.8+dfsg-4+deb12u2","1.3.8+dfsg-4+deb12u3"]},{"source":"osv","ecosystem":"Mageia:9","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8c-1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8b-3.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8b-5.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8b-5.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8b-5.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8b-5.oe2203sp3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8b-150600.13.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8b-150600.13.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6c-2ubuntu0.1"}]}],"versions":["1.3.6-6build2","1.3.6c-1","1.3.6c-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.7c+dfsg-1ubuntu0.1"}]}],"versions":["1.3.7b+dfsg-1","1.3.7c+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8.b+dfsg-1ubuntu0.1"}]}],"versions":["1.3.8+dfsg-8","1.3.8.a+dfsg-1","1.3.8.b+dfsg-1","1.3.8.b+dfsg-1build1","1.3.8.b+dfsg-1build2","1.3.8.b+dfsg-1build3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6c-2ubuntu0.1"}]}],"versions":["1.3.6-6build2","1.3.6c-1","1.3.6c-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.7c+dfsg-1ubuntu0.1"}]}],"versions":["1.3.7b+dfsg-1","1.3.7c+dfsg-1build1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8.b+dfsg-1ubuntu0.1"}]}],"versions":["1.3.8+dfsg-8","1.3.8.a+dfsg-1","1.3.8.b+dfsg-1","1.3.8.b+dfsg-1build1","1.3.8.b+dfsg-1build2","1.3.8.b+dfsg-1build3"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8c-1.1"}]}]}],"products":[{"vendor":"proftpd","product":"proftpd"}],"references":[{"url":"https://github.com/proftpd/proftpd/issues/1830","tags":["report"]},{"url":"https://github.com/proftpd/proftpd/commit/cec01cc0a2523453e5da5a486bc6d977c3768db1","tags":["fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00032.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48651","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mw3w-3jx9-mhff"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-48651","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48651.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-48651","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0015.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33922","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/VVHALJQJ6EOQ3LXU5PV576XZHRQTOZGI/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2508","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251028-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1238141","tags":["report"]},{"url":"https://bugzilla.suse.com/1238143","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57392","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-48651","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-48651","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7297-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-48795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-51713","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VVHALJQJ6EOQ3LXU5PV576XZHRQTOZGI/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-48651","description":"In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.","status":"published","published":"2024-11-29T00:00:00Z","modified":"2025-11-03T22:22:03.568Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:34:11.97482Z"}],"euvd":[{"id":"EUVD-2024-43211","description":"In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.","status":"published","published":"2024-11-29T00:00:00Z","modified":"2025-11-03T22:22:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:29.890052Z"}],"ghsa":[{"id":"GHSA-mw3w-3jx9-mhff","title":"In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access...","description":"In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.","status":"published","published":"2024-11-29T06:35:29Z","modified":"2025-11-04T00:32:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:04:30.667422Z"}],"nvd":[{"id":"CVE-2024-48651","description":"In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.","status":"published","published":"2024-11-29T05:15:05.963Z","modified":"2026-06-17T07:58:40.097Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:10:38.347238Z"}],"osv":[{"id":"ALPINE-CVE-2024-48651","description":"In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.","status":"published","published":"2024-11-29T05:15:05.963Z","modified":"2026-11-07T08:30:02.767487292Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-07T08:42:09.695379Z"},{"id":"CVE-2024-48651","description":"In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.","status":"published","published":"2024-11-29T00:00:00Z","modified":"2026-11-10T07:03:52.024921458Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-09T10:53:57.550641Z"},{"id":"DEBIAN-CVE-2024-48651","description":"In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.","status":"published","published":"2024-11-29T05:15:05.963Z","modified":"2026-11-02T12:03:03.801021231Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:43.798789Z"},{"id":"OESA-2024-2508","title":"proftpd security update","description":"ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple \u0026apos;virtual\u0026apos; FTP servers, anonymous FTP, and permission-based directory visibility. %if 1 This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included. %else This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by xinetd instead are included. %endif\r\n\r\nSecurity Fix(es):\r\n\r\nIn ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.(CVE-2024-48651)","status":"published","published":"2024-12-06T11:07:59Z","modified":"2026-08-18T01:18:42.602531003Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"UBUNTU-CVE-2024-48651","description":"In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.","status":"published","published":"2024-11-29T05:15:00Z","modified":"2026-04-22T15:12:34.136371Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:06.818511Z"},{"id":"DLA-3975-1","title":"proftpd-dfsg - security update","status":"published","published":"2024-11-29T00:00:00Z","modified":"2026-03-09T01:18:13.2429Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5827-1","title":"proftpd-dfsg - security update","status":"published","published":"2024-12-10T00:00:00Z","modified":"2026-03-09T02:11:45.075722Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2025-0015","title":"Updated proftpd packages fix security vulnerability","description":"In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance\ngrants unintended access to GID 0 because of the lack of supplemental\ngroups from mod_sql. (CVE-2024-48651)\n","status":"published","published":"2025-01-20T18:21:44Z","modified":"2026-04-16T04:43:13.092902683Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2025:14636-1","title":"proftpd-1.3.8c-1.1 on GA media","description":"These are all security issues fixed in the proftpd-1.3.8c-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-12T00:00:00Z","modified":"2025-05-07T18:16:20.209289Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2025:1028-1","title":"Security update for proftpd","description":"This update for proftpd fixes the following issues:\n\n- CVE-2024-57392: Fixed null pointer dereference vulnerability by sending a maliciously crafted message (bsc#1238143).\n- CVE-2024-48651: Fixed supplemental group inheritance granting unintended access to GID 0 (bsc#1238141).\n","status":"published","published":"2025-03-26T12:50:07Z","modified":"2026-02-04T02:37:04.823966Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-7297-1","title":"ProFTPD vulnerabilities","description":"Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that the\ntransport protocol implementation in ProFTPD had weak integrity checks.\nAn attacker could use this vulnerability to bypass security features\nlike encryption and integrity checks. (CVE-2023-48795)\n\nMartin Mirchev discovered that ProFTPD did not properly validate user\ninput over the network. An attacker could use this vulnerability to\ncrash ProFTPD or execute arbitrary code. (CVE-2023-51713)\n\nBrian Ristuccia discovered that ProFTPD incorrectly inherited groups\nfrom the parent process. An attacker could use this vulnerability to\nelevate privileges. (CVE-2024-48651)\n","status":"published","published":"2025-02-25T15:13:53Z","modified":"2026-04-27T18:02:26.829725894Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}