What is the CVSS score of CVE-2015-6828?

CVE-2015-6828 has a CVSS 2.0 base score of 6.8 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. EPSS exploitation probability: 0.6%.

Is there a public PoC exploit available for CVE-2015-6828?

Yes, a public proof-of-concept exploit is available for CVE-2015-6828. Prioritise patching immediately. EPSS: 0.6%.

PHP CVE-2015-6828

MEDIUM

Improper Input Validation (CWE-20)

2015-09-16 cve@mitre.org

RCE WordPress PHP Security Audit

6.8

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:P/I:P/A:P

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Sep 16, 2015 - 14:59 cve.org

MEDIUM 6.8

DescriptionCVE.org

The tweet_info function in class/__functions.php in the SecureMoz Security Audit plugin 1.0.5 and earlier for WordPress does not use an HTTPS session for downloading serialized data, which allows man-in-the-middle attackers to conduct PHP object injection attacks and execute arbitrary PHP code by modifying the client-server data stream. NOTE: some of these details are obtained from third party information.

AnalysisAI

The tweet_info function in class/__functions.php in the SecureMoz Security Audit plugin 1.0.5 and earlier for WordPress does not use an HTTPS session for downloading serialized data, which allows. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-20. The tweet_info function in class/__functions.php in the SecureMoz Security Audit plugin 1.0.5 and earlier for WordPress does not use an HTTPS session for downloading serialized data, which allows man-in-the-middle attackers to conduct PHP object injection attacks and execute arbitrary PHP code by modifying the client-server data stream. NOTE: some of these details are obtained from third party information. Affected products include: Securemoz Security Audit.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.