What is the CVSS score of CVE-2015-5287?

CVE-2015-5287 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 12.9%.

Is there a public PoC exploit available for CVE-2015-5287?

Yes, a public proof-of-concept exploit is available for CVE-2015-5287. Prioritise patching immediately. EPSS: 12.9%.

How to fix or mitigate CVE-2015-5287?

Within 24 hours, audit all RHEL 7 systems (Desktop, Server, HPC Node, and Workstation) to identify which have ABRT installed and assess local user account provisioning. Within 7 days, implement compensating controls: disable ABRT entirely via 'systemctl disable abrtd' and 'systemctl stop abrtd', or if operationally critical, enforce restrictive permissions on /var/spool/abrt (chmod 0700, root ownership only). Within 30 days, establish long-term mitigation including upgrade planning to RHEL 8 or later, deployment of SELinux policies to restrict the ABRT ccpp hook, and implementation of filesystem monitoring on coredump directories to detect suspicious symlink operations.

ABRT CVE-2015-5287

HIGH

Improper Link Resolution Before File Access (CWE-59)

2015-12-07 secalert@redhat.com

Information Disclosure Red Hat Enterprise Linux Desktop Enterprise Linux Server Enterprise Linux Workstation Enterprise Linux Hpc Node Automatic Bug Reporting Tool

7.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain local user account on RHEL 7
Delivery

Create symlink at /var/tmp/abrt/abrt-hax-coredump targeting privileged file
Exploit

Trigger application crash to invoke ABRT ccpp hook
Execution

Elevated hook follows symlink and writes coredump to target
Impact

Overwrite privileged file to escalate to root

Vulnerability Assessment

Weakness	CWE CWE-59 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V5 - File Handling Symlink resolution safety
Exploitation Conditions	The attacker must have a local user account on the target RHEL 7 system - unauthenticated remote exploitation is not possible (AV:L confirmed by CVSS). The abrtd service and the ccpp hook must be active, which is the default configuration on RHEL 7. The attacker must have write access to /var/tmp/abrt or /var/spool/abrt to place the symlink - the description notes 'local users with certain permissions,' implying directory write access is required but not necessarily root. The attacker must also be able to trigger a coredump (e.g., via a signal to a crashing application), which is achievable by any user who can run processes. Exploitation is limited to local access only; no network exposure and no UI interaction are required. On systems where abrtd is disabled or the ccpp hook is not registered as the kernel core pattern, exploitation is prevented.
Impact	Real-world risk is high and well-substantiated across multiple signals. CISA KEV confirms active exploitation, consistent with EPSS at 12.90% and the 94th percentile - elevated for a local privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) accurately reflects the attack: local access and a low-privilege account are required, but once positioned, exploitation is low-complexity given the predictable coredump filename. ABRT is installed by default on RHEL 7, broadening the attack surface across server and workstation deployments. A public POC has existed on Exploit-DB since 2015. The combination of KEV status, widely-installed default component, low attack complexity, and high C/I/A impact makes this a genuine priority rather than a theoretical CVSS-inflated concern. No signal conflicts are present; AV:L in the vector is consistent with the local symlink-placement requirement described.
Exploit ScenarioDerived	A low-privileged local user on an unpatched RHEL 7 server creates a symlink at /var/tmp/abrt/abrt-hax-coredump pointing to a sensitive root-owned file such as /etc/passwd or /etc/sudoers, then triggers an application crash (e.g., via kill -SIGSEGV on a suitable process) to invoke the ABRT ccpp hook. The hook, running with elevated privileges, opens the predictable coredump path without O_EXCL, follows the symlink, and writes coredump data to the target file, corrupting or overwriting it to achieve privilege escalation. A working public exploit demonstrating this is available at https://www.exploit-db.com/exploits/38832/.

Act Now Prioritize within 24-48h. Why: HIGH severity + EPSS > 10%.

Exploited in the wild (CISA KEV) No patch listed yet 12.9% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 26, 2026

Local privilege escalation in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows a local user to overwrite arbitrary files by pre-placing a symlink at a predictable coredump path, causing the elevated-privilege ccpp hook to follow the symlink and write attacker-controlled data to the target. Affected systems include RHEL 7.0 Desktop, Server, HPC Node, and Workstation deployments where ABRT is installed by default. This vulnerability is confirmed actively exploited per CISA KEV, has a public exploit on Exploit-DB (#38832), and sits at the 94th EPSS percentile, making it a genuine remediation priority on any RHEL 7 system.

RemediationAI

Vendor-released patch: ABRT 2.7.1, delivered via Red Hat Security Advisory RHSA-2015-2505 (http://rhn.redhat.com/errata/RHSA-2015-2505.html). Apply the errata update via 'yum update abrt' on all RHEL 7 systems immediately. The upstream source fix is at https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740e. If patching is not immediately possible, the primary compensating control is to disable the ABRT ccpp hook by removing or setting 'ProcessUnpackaged = no' in /etc/abrt/abrt-action-save-package-data.conf and stopping the abrtd service ('systemctl stop abrtd'); this eliminates the vulnerable code path but also disables crash reporting entirely. Restricting write access to /var/tmp/abrt and /var/spool/abrt to root-only (chmod 700) would raise the bar but may break legitimate ABRT functionality. Patching is strongly preferred given KEV-confirmed active exploitation.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

ABRT is a Red Hat-developed crash reporting daemon that automatically captures and submits coredumps when applications crash. Its ccpp hook (abrt-hook-ccpp), registered as the kernel core pattern handler, runs with elevated privileges to capture crash data. The root cause (CWE-59: Improper Link Resolution Before File Access) is a classic TOCTOU/symlink-following flaw: the original code used xopen3() with O_WRONLY|O_CREAT|O_TRUNC without O_EXCL, meaning it would silently follow a pre-existing symlink at a predictable path (/var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump) and truncate-write whatever the symlink pointed to. CPE confirms affected scope as cpe:2.3:a:redhat:automatic_bug_reporting_tool:*:*:*:*:*:*:*:* (all versions before 2.7.1) on cpe:2.3:o:redhat:enterprise_linux_server:7.0. The source code fix (commit 3c1b60c) adds an unlink() before the open and switches to O_EXCL, ensuring the file must be newly created and cannot be a pre-existing symlink.

Know when Automatic Bug Reporting Tool gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.8 HIGH

Local symlink attack requires a user account and write access to the coredump directory (PR:L/AV:L); predictable filename and default config keep AC:L; full file overwrite yields C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 26, 2026 - 18:29 vuln.today

v1 - CVSS changed

Severity Changed

Aug 26, 2026 - 18:23 NVD

MEDIUM HIGH

CVSS changed

Aug 26, 2026 - 18:23 NVD

6.9 (MEDIUM) 7.8 (HIGH)

Added to CISA KEV

Aug 26, 2026 - 17:47 CISA

CVE Published

Dec 07, 2015 - 18:59 cve.org

MEDIUM 6.9

DescriptionNVD

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.

Executive ViewAI

Why It Matters

Automatic Bug Reporting Tool (ABRT), installed by default on all RHEL 7 systems, enables unprivileged users to achieve root-level access through a known vulnerability confirmed as actively exploited (CISA KEV). This flaw affects every RHEL 7 desktop and server across the organization unless compensating controls are implemented. Remediation is urgent as exploitation is occurring in the field and no vendor patch is available.

Business Impact: Severe

Compensating Controls

Disable ABRT service immediately (systemctl disable abrtd && systemctl stop abrtd) or restrict /var/spool/abrt to root-only access (chmod 0700). Implement file integrity monitoring and filesystem auditing on coredump paths to detect symlink race conditions. Restrict local user account creation to essential users only and review existing unprivileged account assignments. Isolate RHEL 7 systems via network segmentation where possible. Plan and execute upgrades to RHEL 8 or later as the permanent solution.

Threat Intelligence Overview

Threat Score

4.9/10

Composite threat intelligence

EPSS Score

12.9%

Top 6% exploitable

Prevalence

Medium

default component on RHEL 7, limited to Red Hat ecosystem

Exploit

POC

Public exploit code exists

Data Quality

8 sources

Confidence: High

NVD

CVE.org

CISA KEV

EPSS POC (1)

Exploit-DB

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV Yes

Public POC Yes

EPSS 12.9%

Patch available No

Active threat Yes

Deciding rule

HIGH severity + EPSS > 10%

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Active

System Exposure· derived

Small

Automatable· derived

Human Impact

Very High

Priority Score

137

Low Medium High Critical

KEV: +50

EPSS: +13

CVSS: +39

PoC: +20

Weaponized: +15

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.