CVE-2015-2775: canonical ubuntu_linux Path Traversal
CVSS: 7.6v2.0HighModified
AliasesMGASA-2015-0205RHSA-2015:1153UBUNTU-CVE-2015-2775USN-2558-1DLA-186-1DSA-3214-1
Published 13-04-2015Last modified 06-08-2024
Vulnerability summary
CVE-2015-2775 is a high (CVSS 7.6) Path Traversal vulnerability in canonical ubuntu_linux. EPSS estimates a 7.91% chance of exploitation in the next 30 days, higher than 94.6% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.6/10
010
High · v2.0 (NVD)EPSS score
7.91%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 13-04-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.
CVSS metrics
1 score · 1 source · 1 versionHigh 7.6Preferred score · NVD (NIST)
AV:N/AC:H/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
7.91%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 7.91% on 19-09-2026
19-09-202619-10-2026
EPSS score7.91%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (mail.python.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat3 products
- enterprise_linuxEOL7.0
- mailman< 3:2.1.15-21.ael7b_1 | < 3:2.1.15-21.el7_1
- mailman-debuginfo< 3:2.1.15-21.ael7b_1 | < 3:2.1.15-21.el7_1
Debian2 products
- mailman< 1:2.1.13-6 | < 1:2.1.15-1+deb7u1
- debian_linuxEOL7.0
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 14.10
Gnu1 product
- mailman≤ 2.1.19
Mageia1 product
- mailman< 2.1.20-1.1.mga4
Ubuntu1 product
- mailman< 1:2.1.16-2ubuntu0.1
6 vendors · 9 products
References
26 links- bugs.launchpad.net/mailman/+bug/1437145X Refsource CONFIRM
- lists.fedoraproject.org/pipermail/package-announce/2015-April/154911.htmlVendor AdvisoryX Refsource FEDORA
- lists.fedoraproject.org/pipermail/package-announce/2015-April/156742.htmlVendor AdvisoryX Refsource FEDORA
- mail.python.org/pipermail/mailman-developers/2015-March/024871.htmlMailing ListX Refsource MLISTVendor Advisory
- mail.python.org/pipermail/mailman-developers/2015-March/024875.htmlMailing ListX Refsource MLISTExploitREPORT
