CVE-2019-12815 Common Vulnerabilities and Exposures

Upstream information

CVE-2019-12815 at MITRE

Description

An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having critical severity.

CVSS v2 Scores
	National Vulnerability Database
Base Score	7.5
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
Access Vector	Network
Access Complexity	Low
Authentication	None
Confidentiality Impact	Partial
Integrity Impact	Partial
Availability Impact	Partial

CVSS v3 Scores
	National Vulnerability Database
Base Score	9.8
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	None
Scope	Unchanged
Confidentiality Impact	High
Integrity Impact	High
Availability Impact	High
CVSSv3 Version	3.1

SUSE Bugzilla entry: 1142281 [RESOLVED / FIXED]

SUSE Security Advisories:

openSUSE-SU-2019:1836-1, published Fri Dec 8 15:48:42 2023
openSUSE-SU-2019:1870-1, published Fri Dec 8 15:48:42 2023
openSUSE-SU-2020:0031-1, published Thu Dec 7 12:55:39 2023

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	`proftpd >= 1.3.8b-150600.13.6.1` `proftpd-devel >= 1.3.8b-150600.13.6.1` `proftpd-doc >= 1.3.8b-150600.13.6.1` `proftpd-lang >= 1.3.8b-150600.13.6.1` `proftpd-ldap >= 1.3.8b-150600.13.6.1` `proftpd-mysql >= 1.3.8b-150600.13.6.1` `proftpd-pgsql >= 1.3.8b-150600.13.6.1` `proftpd-radius >= 1.3.8b-150600.13.6.1` `proftpd-sqlite >= 1.3.8b-150600.13.6.1`	Patchnames: SUSE Linux Enterprise Module for Server Applications 15 SP7 GA proftpd-1.3.8b-150600.13.6.1
SUSE Package Hub 15 SP1	`proftpd >= 1.3.6b-bp151.4.6.2` `proftpd-devel >= 1.3.6b-bp151.4.6.2` `proftpd-doc >= 1.3.6b-bp151.4.6.2` `proftpd-lang >= 1.3.6b-bp151.4.6.2` `proftpd-ldap >= 1.3.6b-bp151.4.6.2` `proftpd-mysql >= 1.3.6b-bp151.4.6.2` `proftpd-pgsql >= 1.3.6b-bp151.4.6.2` `proftpd-radius >= 1.3.6b-bp151.4.6.2` `proftpd-sqlite >= 1.3.6b-bp151.4.6.2`	Patchnames: openSUSE-2019-1870 openSUSE-2020-31
SUSE Package Hub 15	`proftpd >= 1.3.6b-bp150.3.6.1` `proftpd-devel >= 1.3.6b-bp150.3.6.1` `proftpd-doc >= 1.3.6b-bp150.3.6.1` `proftpd-lang >= 1.3.6b-bp150.3.6.1` `proftpd-ldap >= 1.3.6b-bp150.3.6.1` `proftpd-mysql >= 1.3.6b-bp150.3.6.1` `proftpd-pgsql >= 1.3.6b-bp150.3.6.1` `proftpd-radius >= 1.3.6b-bp150.3.6.1` `proftpd-sqlite >= 1.3.6b-bp150.3.6.1`	Patchnames: openSUSE-2019-1836 openSUSE-2020-31
openSUSE Leap 15.0	`proftpd >= 1.3.5e-lp150.2.3.1` `proftpd-devel >= 1.3.5e-lp150.2.3.1` `proftpd-doc >= 1.3.5e-lp150.2.3.1` `proftpd-lang >= 1.3.5e-lp150.2.3.1` `proftpd-ldap >= 1.3.5e-lp150.2.3.1` `proftpd-mysql >= 1.3.5e-lp150.2.3.1` `proftpd-pgsql >= 1.3.5e-lp150.2.3.1` `proftpd-radius >= 1.3.5e-lp150.2.3.1` `proftpd-sqlite >= 1.3.5e-lp150.2.3.1`	Patchnames: openSUSE-2019-1836
openSUSE Leap 15.1	`proftpd >= 1.3.6b-lp151.3.6.1` `proftpd-devel >= 1.3.6b-lp151.3.6.1` `proftpd-doc >= 1.3.6b-lp151.3.6.1` `proftpd-lang >= 1.3.6b-lp151.3.6.1` `proftpd-ldap >= 1.3.6b-lp151.3.6.1` `proftpd-mysql >= 1.3.6b-lp151.3.6.1` `proftpd-pgsql >= 1.3.6b-lp151.3.6.1` `proftpd-radius >= 1.3.6b-lp151.3.6.1` `proftpd-sqlite >= 1.3.6b-lp151.3.6.1`	Patchnames: openSUSE-2019-1836 openSUSE-2020-31
openSUSE Tumbleweed	`proftpd >= 1.3.6e-1.10` `proftpd-devel >= 1.3.6e-1.10` `proftpd-doc >= 1.3.6e-1.10` `proftpd-lang >= 1.3.6e-1.10` `proftpd-ldap >= 1.3.6e-1.10` `proftpd-mysql >= 1.3.6e-1.10` `proftpd-pgsql >= 1.3.6e-1.10` `proftpd-radius >= 1.3.6e-1.10` `proftpd-sqlite >= 1.3.6e-1.10`	Patchnames: openSUSE-Tumbleweed-2024-11196

SUSE Timeline for this CVE

CVE page created: Sat Jul 20 05:21:34 2019
CVE page last modified: Tue Jul 15 12:20:41 2025