What’s Vulnerable › Vulnerabilities

CVE-2024-48651

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-11-29 · updated 2026-06-17
• Weakness: CWE-863

Description

In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.

Affected products

• ProFTPD: through 1.3.8b; before cec01cc — fixed in cec01cc

How to fix

Upgrade to a fixed version: ProFTPD cec01cc. Check the vendor advisory for mitigations.

References

• https://github.com/proftpd/proftpd/commit/cec01cc0a2523453e5da5a486bc6d977c3768db1
• https://github.com/proftpd/proftpd/issues/1830
• https://lists.debian.org/debian-lts-announce/2024/11/msg00032.html

Get alerted when CVE-2024-48651 or the next vulnerability affects your stack