What is the CVSS score of CVE-2015-3330?

CVE-2015-3330 has a CVSS 2.0 base score of 6.8 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. EPSS exploitation probability: 39.0%.

Is there a public PoC exploit available for CVE-2015-3330?

Yes, a public proof-of-concept exploit is available for CVE-2015-3330. Prioritise patching immediately. EPSS: 39.0%.

Is there a patch available for CVE-2015-3330?

Yes, a patch is available for CVE-2015-3330. Update the affected software to the latest version immediately.

PHP CVE-2015-3330

MEDIUM

Improper Input Validation (CWE-20)

2015-06-09 cve@mitre.org

RCE PHP Denial Of Service Apache Linux Solaris Mac Os X Enterprise Linux Enterprise Linux Desktop Enterprise Linux Hpc Node Enterprise Linux Hpc Node Eus Enterprise Linux Server Enterprise Linux Server Eus Enterprise Linux Workstation

6.8

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:P/I:P/A:P

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Jun 09, 2015 - 18:59 cve.org

MEDIUM 6.8

DescriptionCVE.org

The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that result in a "deconfigured interpreter."

AnalysisAI

The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 39.0%.

Technical ContextAI

This vulnerability is classified under CWE-20. The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that result in a "deconfigured interpreter." Affected products include: Oracle Linux, Oracle Solaris, Apple Mac Os X, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop. Version information: before 5.4.40.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.