PT-2024-8957 · Proftpd+4 · Proftpd+4

Hpreusse

·

Published

2024-09-22

·

Updated

2026-03-10

·

CVE-2024-48651

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions: ProFTPD versions 1.3.8b and earlier
Description: The issue is related to supplemental group inheritance, which grants unintended access to GID 0 due to the lack of supplemental groups from mod sql. This could allow attackers to escalate privileges to root level, potentially compromising the entire server. It is estimated that over 7 million services are affected. The vulnerability can be exploited by attackers to gain root access to vulnerable systems.
Recommendations: For ProFTPD version 1.3.8b and earlier, update to a version that includes the fix for this issue, which is available after the update cec01cc. As a temporary workaround, consider restricting access to the vulnerable mod sql module until a patch is available.

Fix

Improper Privilege Management

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2024-10638
CVE-2024-48651
DLA-3975-1
DSA-5827-1
MGASA-2025-0015
OESA-2024-2508
OPENSUSE-SU-2025:14636-1
OPENSUSE-SU-2025_1028-1
SUSE-SU-2025:1028-1
SUSE-SU-2025_1028-1
USN-7297-1

Affected Products

Linuxmint
Proftpd
Red Os
Suse
Ubuntu