9.6

CVE-2015-5211: debian debian_linux

CVSS: 9.6v3.1CriticalModified
AliasesMGASA-2015-0426UBUNTU-CVE-2015-5211DEBIAN-CVE-2015-5211
Published 25-05-2017Last modified 06-08-2024
Open JSON

Vulnerability summary

CVE-2015-5211 is a critical (CVSS 9.6) vulnerability in debian debian_linux. EPSS estimates a 2.56% chance of exploitation in the next 30 days, higher than 84.8% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.6/10
010
Critical · v3.1 (NVD)
EPSS score
2.56%
0%100%
Low · -0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 2 · Related 1
DLA-1853-1USN-4774-1

Timeline

  1. 25-05-2017
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.

CVSS metrics

6 scores · 4 sources · 3 versions

EPSS trend

Probability

2.56%

Chance of exploitation in the next 30 days

Percentile

85%

Versus all other CVEs

30-day change

-0.01 pp

From 2.57% on 19-09-2026

19-09-202619-10-2026
EPSS score
2.56%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (trustwave.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Mageia3 products
  • json-path< 0.9.1-1.mga5
  • json-smart< 1.3-0.20140820.1.mga5
  • springframework< 3.2.15-1.mga5
Debian2 products
Org.springframework1 product
  • spring-core≥ 4.2.0, < 4.2.2 | ≥ 4.0.0, < 4.1.8 | < 3.2.15
Ubuntu1 product
  • libspring-java< 3.0.6.RELEASE-13ubuntu0.1~esm2 | < 3.2.13-5ubuntu0.1~esm1
Vmware1 product
  • spring_framework3.2.0 | 3.2.1 | 3.2.2 | 3.2.3 | 3.2.4 | 3.2.5 | 3.2.6 | 3.2.7 | 3.2.8 | 3.2.9 | 3.2.10 | 3.2.11 | 3.2.12 | 3.2.13 | 3.2.14 | 4.0.0 | 4.0.1 | 4.0.2 | 4.0.3 | 4.0.4 | 4.0.5 | 4.0.6 | 4.0.7 | 4.0.8 | 4.0.9 | 4.1.0 | 4.1.1 | 4.1.2 | 4.1.3 | 4.1.4 | 4.1.5 | 4.1.6 | 4.1.7 | 4.2.0 | 4.2.1

5 vendors · 8 products

References

21 links
Show all 21 references