Evil-DB LogoEvil-DB
← All CVEs

CVE-2015-8562

high · 7.5

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.

7.5
CVSS
98.3%
EPSS (exploit prob.)
100th
EPSS percentile
2015-12-16
Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-20

Affected products

VendorProductAffected versions
joomlajoomla!1.5.0
joomlajoomla!1.5.1
joomlajoomla!1.5.2
joomlajoomla!1.5.3
joomlajoomla!1.5.4
joomlajoomla!1.5.6
joomlajoomla!1.5.7
joomlajoomla!1.5.8
joomlajoomla!1.5.9
joomlajoomla!1.5.10
joomlajoomla!1.5.11
joomlajoomla!1.5.12
joomlajoomla!1.5.13
joomlajoomla!1.5.14
joomlajoomla!1.5.15
joomlajoomla!1.5.16
joomlajoomla!1.5.17
joomlajoomla!1.5.18
joomlajoomla!1.5.19
joomlajoomla!1.5.20
joomlajoomla!1.5.21
joomlajoomla!1.5.22
joomlajoomla!1.5.23
joomlajoomla!1.5.24
joomlajoomla!1.5.25
joomlajoomla!1.5.26
joomlajoomla!1.6.0
joomlajoomla!1.6.1
joomlajoomla!1.6.2
joomlajoomla!1.6.3
joomlajoomla!1.6.4
joomlajoomla!1.6.5
joomlajoomla!1.6.6
joomlajoomla!1.7.0
joomlajoomla!1.7.1
joomlajoomla!1.7.2
joomlajoomla!1.7.3
joomlajoomla!1.7.4
joomlajoomla!1.7.5
joomlajoomla!2.5.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2015-8562