ProFTPD Vulnerable to Improper Access Control Flaw (CVE-2019-12815)

Researcher Tobias Mädel released an advisory on July 18 for a vulnerability in ProFTPD, a popular open source FTP daemon for Unix and Unix-like operating systems, that has existed since 2010.

The vulnerability, designated as CVE-2019-12815, is an improper access control in the ProFTPD ‘mod_copy’ module due to the fact that it does not honor specific configuration settings in the proftpd.conf file.

Initially thought to have been patched in version 1.3.6 of ProFTPD, Mädel updated his advisory on July 23 to indicate that the vulnerability still persists in ProFTPD 1.3.6 and that no patch is currently available for it.

For more details about this event, please visit our blog.