What is the CVSS score of CVE-2015-5273?

CVE-2015-5273 has a CVSS 2.0 base score of 3.6 (Low). CVSS vector: AV:L/AC:L/Au:N/C:N/I:P/A:P. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2015-5273?

Yes, a public proof-of-concept exploit is available for CVE-2015-5273. Prioritise patching immediately. EPSS: 0.3%.

Automatic Bug Reporting Tool CVE-2015-5273

LOW

Improper Link Resolution Before File Access (CWE-59)

2015-12-07 secalert@redhat.com

Information Disclosure Automatic Bug Reporting Tool Enterprise Linux Desktop Enterprise Linux Hpc Node Enterprise Linux Server Enterprise Linux Workstation

3.6

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

3.6 LOW

AV:L/AC:L/Au:N/C:N/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:L/AC:L/Au:N/C:N/I:P/A:P

Attack Vector

Local

Attack Complexity

Low

Confidentiality

None

Integrity

Availability

Lifecycle Timeline

CVE Published

Dec 07, 2015 - 18:59 cve.org

LOW 3.6

DescriptionCVE.org

The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users to write to arbitrary files via a symlink attack on unpacked.cpio in a pre-created directory with a predictable name in /var/tmp.

AnalysisAI

The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users to write to arbitrary files via a symlink attack on unpacked.cpio. Rated low severity (CVSS 3.6), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-59. The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users to write to arbitrary files via a symlink attack on unpacked.cpio in a pre-created directory with a predictable name in /var/tmp. Affected products include: Redhat Automatic Bug Reporting Tool, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Hpc Node, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation. Version information: before 2.7.1.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.