What is the CVSS score of CVE-2015-8866?

CVE-2015-8866 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 3.5%.

Is there a public PoC exploit available for CVE-2015-8866?

Yes, a public proof-of-concept exploit is available for CVE-2015-8866. Prioritise patching immediately. EPSS: 3.5%.

Is there a patch available for CVE-2015-8866?

Yes, a patch is available for CVE-2015-8866. Update the affected software to the latest version immediately.

PHP CVE-2015-8866

CRITICAL

Improper Restriction of XML External Entity Reference (CWE-611)

2016-05-22 cve@mitre.org

XXE PHP Ubuntu Linux Leap Opensuse Linux Enterprise Module For Web Scripting Linux Enterprise Software Development Kit

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

May 22, 2016 - 01:59 cve.org

CRITICAL 9.6

DescriptionCVE.org

ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.

AnalysisAI

ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161. Affected products include: Php, Canonical Ubuntu Linux, Opensuse Leap, Opensuse, Suse Linux Enterprise Module For Web Scripting. Version information: before 5.5.22.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Disable external entity processing in XML parsers, use JSON instead of XML where possible.