Unscored severity · published Dec 6, 2011
CVE-2011-4130
Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs…
–
CVSS
12.6%
EPSS
No
On KEV
Description
Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.
Exploitation
Is it being used?
Exploit prediction (EPSS)12.6% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Proftpd · Proftpd
through 1.3.3; 1.2.0; 1.2.0; 1.2.0; 1.2.0; 1.2.0; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-4130
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-4130
Exploit
http://bugs.proftpd.org/show_bug.cgi?id=3711
www.proftpd.org
http://www.proftpd.org/docs/NEWS-1.3.3g
www.securityfocus.com
http://www.securityfocus.com/bid/50631
www.zerodayinitiative.com
http://www.zerodayinitiative.com/advisories/ZDI-11-328/
More from Proftpd
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2010-20103
A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010
9.8
CVE-2019-12815
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to…
8.8
CVE-2026-63090
ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly
8.8
CVE-2020-9273
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel