CVE-2019-12815

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 57.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-07-19 · updated 2026-06-17
Weakness: CWE-755

Description

An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.

Affected products

Debian Linux: 8.0, 9.0, 10.0
Fedoraproject Fedora: 29, 30
ProFTPD: through 1.3.5b
Siemens SIMATIC CP 1543-1 V4.0: from 2.0 before 2.2 — fixed in 2.2

How to fix

Upgrade to a fixed version: Siemens SIMATIC CP 1543-1 V4.0 2.2. Check the vendor advisory for mitigations.

References

http://bugs.proftpd.org/show_bug.cgi?id=4372
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00004.html
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00022.html
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html
http://www.securityfocus.com/bid/109339
https://cert-portal.siemens.com/productcert/pdf/ssa-940889.pdf
https://github.com/proftpd/proftpd/pull/816
https://lists.debian.org/debian-lts-announce/2019/08/msg00006.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OJDQ3XUYWO42TJBO53NUWDZRA35QMVEI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XM5FPBAGSIKV6YJZEPM6GPGJO5JFT7XU/
https://seclists.org/bugtraq/2019/Aug/3
https://security.gentoo.org/glsa/201908-16

Get alerted when CVE-2019-12815 or the next vulnerability affects your stack