CVE-2019-12815
CriticalAn arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.
Published Jul 19, 2019 · Updated Aug 7, 2026 · Also known as DEBIAN-CVE-2019-12815, DLA-1873-1, DSA-4491-1, UBUNTU-CVE-2019-12815
Key Facts
Patch immediately- CVE-2019-12815 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Proftpd, Debian Linux, Fedora (Fedoraproject) and 10 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 58% probability of exploitation in the next 30 days.
- Fixed versions are available, including Proftpd 1.3.5e-bp150.3.3.1, Proftpd 1.3.5e-bp151.4.3.1, Proftpd 1.3.6b-bp151.4.6.2.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
58%
Higher than 99.0% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2019-12815 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.
Affected Products
65 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| ProftpdProftpd | See advisory | 1.3.5b |
| Debian LinuxDebian | 10.0, 8.0, 9.0 | n/a |
| FedoraFedoraproject | 29, 30 | n/a |
| Simatic Cp 1543-1 FirmwareSiemens | See advisory | 2.2 |
| proftpd-dfsgdebian | See advisory | 1.3.6-6 |
Patched Releases
Proftpd
1.3.5e-bp150.3.3.1, 1.3.5e-bp151.4.3.1, 1.3.6b-bp151.4.6.2, 1.3.6e-1.10, <=1.3.5b
proftpd-devel
1.3.5e-bp150.3.3.1, 1.3.5e-bp151.4.3.1, 1.3.6b-bp151.4.6.2, 1.3.6e-1.10
proftpd-dfsg
1.3.5b-4+deb9u1, 1.3.5e+r1.3.5-2+deb8u3, 1.3.6-4+deb10u1, 1.3.6-6
proftpd-doc
1.3.5e-bp150.3.3.1, 1.3.5e-bp151.4.3.1, 1.3.6b-bp151.4.6.2, 1.3.6e-1.10
proftpd-lang
1.3.5e-bp150.3.3.1, 1.3.5e-bp151.4.3.1, 1.3.6b-bp151.4.6.2, 1.3.6e-1.10
proftpd-ldap
1.3.5e-bp150.3.3.1, 1.3.5e-bp151.4.3.1, 1.3.6b-bp151.4.6.2, 1.3.6e-1.10
proftpd-mysql
1.3.5e-bp150.3.3.1, 1.3.5e-bp151.4.3.1, 1.3.6b-bp151.4.6.2, 1.3.6e-1.10
proftpd-pgsql
1.3.5e-bp150.3.3.1, 1.3.5e-bp151.4.3.1, 1.3.6b-bp151.4.6.2, 1.3.6e-1.10
proftpd-radius
1.3.5e-bp150.3.3.1, 1.3.5e-bp151.4.3.1, 1.3.6b-bp151.4.6.2, 1.3.6e-1.10
proftpd-sqlite
1.3.5e-bp150.3.3.1, 1.3.5e-bp151.4.3.1, 1.3.6b-bp151.4.6.2, 1.3.6e-1.10
Simatic Cp 1543-1 Firmware
2.2
Timeline
Publicly disclosed
Jul 19, 2019
Last updated
Aug 7, 2026
Weakness Type
- CWE-755 Improper Handling of Exceptional Conditions
References
- advisoryhttps://cert-portal.siemens.com/productcert/pdf/ssa-940889.pdf
- advisory[debian-lts-announce] 20190807 [SECURITY] [DLA 1873-1] proftpd-dfsg security update
- advisory20190805 [SECURITY] [DSA 4491-1] proftpd-dfsg security update
- advisoryGLSA-201908-16
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2019-12815
FAQ
Common Questions.
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.
Affected: Proftpd; Debian Linux versions 10.0, 8.0, 9.0; Fedora (Fedoraproject) versions 29, 30, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Proftpd 1.3.5e-bp150.3.3.1, Proftpd 1.3.5e-bp151.4.3.1, Proftpd 1.3.6b-bp151.4.6.2.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2019-12815 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo