CVE-2015-3306

ProFTPD's improper access control in cpfr/cpto commands allowed remote attackers to read/write arbitrary files, a KEV vulnerability exploited in the wild.

ProFTPD's site cpfr and cpto commands lacked proper access controls, enabling remote attackers to read and write arbitrary files. This KEV vulnerability was actively exploited in the wild, posing a severe risk to systems using ProFTPD for file transfers. DIB organizations must ensure all ProFTPD instances are patched immediately and monitor for exploitation attempts.

Shame score — A known access control flaw in a widely used FTP server was left unpatched long enough to be added to CISA's KEV catalog and actively exploited in the wild, demonstrating severe negligence in patch management.