CVE-2015-10003: FileZilla Server PORT confused deputy
Vulnerability summary
CVE-2015-10003 is a medium (CVSS 4.3) Unintended Proxy or Intermediary vulnerability in filezilla-project filezilla_server. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 46.5% of scored vulnerabilities.
Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 17-07-2022PublishedVulnerability first disclosed.
- 15-04-2025Last modifiedVulnerability information updated.
Description
A vulnerability, which was classified as problematic, was found in FileZilla Server up to 0.9.50. This affects an unknown part of the component PORT Handler. The manipulation leads to unintended intermediary. It is possible to initiate the attack remotely. Upgrading to version 0.9.51 is able to address this issue. It is recommended to upgrade the affected component.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.56%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.56% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-441Unintended Proxy or IntermediaryThe product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere.
- CWE-610Externally Controlled Reference to a Resource in Another SphereThe product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Filezilla1 product
- server0.9.0 | 0.9.1 | 0.9.2 | 0.9.3 | 0.9.4 | 0.9.5 | 0.9.6 | 0.9.7 | 0.9.8 | 0.9.9 | 0.9.10 | 0.9.11 | 0.9.12 | 0.9.13 | 0.9.14 | 0.9.15 | 0.9.16 | 0.9.17 | 0.9.18 | 0.9.19 | 0.9.20 | 0.9.21 | 0.9.22 | 0.9.23 | 0.9.24 | 0.9.25 | 0.9.26 | 0.9.27 | 0.9.28 | 0.9.29 | 0.9.30 | 0.9.31 | 0.9.32 | 0.9.33 | 0.9.34 | 0.9.35 | 0.9.36 | 0.9.37 | 0.9.38 | 0.9.39 | 0.9.40 | 0.9.41 | 0.9.42 | 0.9.43 | 0.9.44 | 0.9.45 | 0.9.46 | 0.9.47 | 0.9.48 | 0.9.49 | 0.9.50
Filezilla-project1 product
- filezilla_server< 0.9.51
2 vendors · 2 products
References
2 links- www.securitygalore.com/site3/filezilla_ftp_server_advisoryX Refsource MISCPatchTechnical DescriptionThird Party Advisory