High severity · published Jan 14, 2020
CVE-2015-3151
Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write to, or change ownership of arbitrary files via unspecified…
7.8
CVSS
0.6%
EPSS
No
On KEV
Description
Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write to, or change ownership of arbitrary files via unspecified vectors to the (1) NewProblem, (2) GetInfo, (3) SetElement, or (4) DeleteElement method.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Automatic Bug Reporting Tool · Redhat
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-3151
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-3151
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-3151
Patch
https://github.com/abrt/abrt/commit/7a47f57975be0d285a2f20758e4572dca6d9cdd3
Patch
https://github.com/abrt/abrt/commit/c796c76341ee846cfb897ed645bac211d7d0a932
Patch
https://github.com/abrt/abrt/commit/f3c2a6af3455b2882e28570e8a04f1c2d4500d5b
Patch
https://github.com/abrt/libreport/commit/239c4f7d1f47265526b39ad70106767d00805277
Patch
https://github.com/abrt/libreport/commit/54ecf8d017580b495d6501e53ca54e453a73a364
More from Automatic Bug Reporting Tool
7.8
CVE-2015-5287
Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
7.8
CVE-2026-54230
Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites
7.8
CVE-2015-3159
The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly handle the process environment before invoking…
7.8
CVE-2015-1869
The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demonstrated by a symlink attack on a var_log_messages file
7.8
CVE-2015-3315
Automatic Bug Reporting Tool (ABRT) allows local users to read, change the ownership of, or have other unspecified impact on arbitrary files via a symlink attack on (1)…