CVE-2015-8562
N/A
Published: December 16, 2015 at 09:00 PM UTC
Updated: June 17, 2026 at 12:34 AM UTC
1 product affected across 1 vendorJoomla!
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 98%
Description
Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
1.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.191.5.21.5.201.5.211.5.221.5.231.5.241.5.251.5.261.5.31.5.41.5.61.5.71.5.81.5.91.6.01.6.11.6.21.6.31.6.41.6.51.6.61.7.01.7.11.7.21.7.31.7.41.7.52.5.02.5.12.5.102.5.112.5.122.5.132.5.142.5.152.5.162.5.172.5.182.5.192.5.22.5.202.5.212.5.222.5.232.5.242.5.252.5.262.5.272.5.282.5.32.5.42.5.52.5.62.5.72.5.82.5.93.0.03.0.13.0.23.0.33.1.03.1.13.1.23.1.33.1.43.1.53.1.63.2.03.2.13.2.23.2.33.2.43.3.03.3.13.3.23.3.33.3.43.4.03.4.13.4.23.4.33.4.43.4.5
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (9)
x_refsource_MISCExploit
Source: [email protected]
http://packetstormsecurity.com/files/134949/Joomla-HTTP-Header-Unauthenticated-Remote-Code-Execution.htmlx_refsource_MISC
Source: [email protected]
http://packetstormsecurity.com/files/135100/Joomla-3.4.5-Object-Injection.htmlx_refsource_MISC
Source: [email protected]
http://www.rapid7.com/db/modules/exploit/multi/http/joomla_http_header_rceMailing Listx_refsource_BUGTRAQ
Source: [email protected]
http://www.securityfocus.com/archive/1/537219/100/0/threadedx_refsource_MISCExploit
Source: [email protected]
https://blog.sucuri.net/2015/12/remote-command-execution-vulnerability-in-joomla.htmlx_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.htmlQuick Info
StatusMODIFIED
CWE
CWE-20
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card