What is the CVSS score of CVE-2015-5287?

CVE-2015-5287 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 12.9%.

Which versions of ABRT are affected by CVE-2015-5287?

Automatic Bug Reporting Tool (ABRT), installed by default on all RHEL 7 systems, enables unprivileged users to achieve root-level access through a known vulnerability confirmed as actively exploited…

Is there a public PoC exploit available for CVE-2015-5287?

Yes, a public proof-of-concept exploit is available for CVE-2015-5287. Prioritise patching immediately. EPSS: 12.9%.

How to fix or mitigate CVE-2015-5287?

Within 24 hours, audit all RHEL 7 systems (Desktop, Server, HPC Node, and Workstation) to identify which have ABRT installed and assess local user account provisioning. Within 7 days, implement compensating controls: disable ABRT entirely via 'systemctl disable abrtd' and 'systemctl stop abrtd', or if operationally critical, enforce restrictive permissions on /var/spool/abrt (chmod 0700, root ownership only). Within 30 days, establish long-term mitigation including upgrade planning to RHEL 8 or later, deployment of SELinux policies to restrict the ABRT ccpp hook, and implementation of filesystem monitoring on coredump directories to detect suspicious symlink operations.

ABRT CVE-2015-5287

HIGH

Improper Link Resolution Before File Access (CWE-59)

2015-12-07 secalert@redhat.com

Information Disclosure Automatic Bug Reporting Tool Enterprise Linux Desktop Enterprise Linux Hpc Node Enterprise Linux Server Enterprise Linux Workstation

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local symlink attack requires a user account and write access to the coredump directory (PR:L/AV:L); predictable filename and default config keep AC:L; full file overwrite yields C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Aug 26, 2026 - 18:29 vuln.today

Analysis Updated

Aug 26, 2026 - 18:29 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 26, 2026 - 18:23 vuln.today

cvss_changed

Severity Changed

Aug 26, 2026 - 18:23 NVD

MEDIUM HIGH

CVSS changed

Aug 26, 2026 - 18:23 NVD

6.9 (MEDIUM) 7.8 (HIGH)

Added to CISA KEV

Aug 26, 2026 - 17:47 CISA

CVE Published

Dec 07, 2015 - 18:59 cve.org

MEDIUM 6.9

DescriptionNVD

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.

AnalysisAI

Local privilege escalation in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows a local user to overwrite arbitrary files by pre-placing a symlink at a predictable coredump path, causing the elevated-privilege ccpp hook to follow the symlink and write attacker-controlled data to the target. Affected systems include RHEL 7.0 Desktop, Server, HPC Node, and Workstation deployments where ABRT is installed by default. This vulnerability is confirmed actively exploited per CISA KEV, has a public exploit on Exploit-DB (#38832), and sits at the 94th EPSS percentile, making it a genuine remediation priority on any RHEL 7 system.

Technical ContextAI

ABRT is a Red Hat-developed crash reporting daemon that automatically captures and submits coredumps when applications crash. Its ccpp hook (abrt-hook-ccpp), registered as the kernel core pattern handler, runs with elevated privileges to capture crash data. The root cause (CWE-59: Improper Link Resolution Before File Access) is a classic TOCTOU/symlink-following flaw: the original code used xopen3() with O_WRONLY|O_CREAT|O_TRUNC without O_EXCL, meaning it would silently follow a pre-existing symlink at a predictable path (/var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump) and truncate-write whatever the symlink pointed to. CPE confirms affected scope as cpe:2.3:a:redhat:automatic_bug_reporting_tool:*:*:*:*:*:*:*:* (all versions before 2.7.1) on cpe:2.3:o:redhat:enterprise_linux_server:7.0. The source code fix (commit 3c1b60c) adds an unlink() before the open and switches to O_EXCL, ensuring the file must be newly created and cannot be a pre-existing symlink.

RemediationAI

Vendor-released patch: ABRT 2.7.1, delivered via Red Hat Security Advisory RHSA-2015-2505 (http://rhn.redhat.com/errata/RHSA-2015-2505.html). Apply the errata update via 'yum update abrt' on all RHEL 7 systems immediately. The upstream source fix is at https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740e. If patching is not immediately possible, the primary compensating control is to disable the ABRT ccpp hook by removing or setting 'ProcessUnpackaged = no' in /etc/abrt/abrt-action-save-package-data.conf and stopping the abrtd service ('systemctl stop abrtd'); this eliminates the vulnerable code path but also disables crash reporting entirely. Restricting write access to /var/tmp/abrt and /var/spool/abrt to root-only (chmod 700) would raise the bar but may break legitimate ABRT functionality. Patching is strongly preferred given KEV-confirmed active exploitation.