« Volver al listado

CVE-2015-7265

Estado: ModificadaAlta (7.5)—

Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Proxygen Project — Proxygen

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-7265",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Facebook Proxygen before 2015-11-09",
          "versions": [
            {
              "status": "affected",
              "version": "Facebook Proxygen before 2015-11-09"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-04-10T03:59:00.717",
  "references": [
    {
      "url": "https://groups.google.com/forum/#%21topic/facebook-proxygen/K8wCXbW4ihs",
      "source": "cret@cert.org"
    },
    {
      "url": "https://groups.google.com/forum/#%21topic/facebook-proxygen/K8wCXbW4ihs",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks."
    },
    {
      "lang": "es",
      "value": "Facebook Proxygen en versiones anteriores a 11/09/2015 no gestiona adecuadamente el estado HTTPMessage.request, lo que permite a atacantes remotos llevar a cabo ataques de secuestro y eludir comprobaciones ACL."
    }
  ],
  "lastModified": "2026-06-17T00:32:09.500",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:proxygen_project:proxygen:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DACA5AC9-E574-4B8E-8779-D328CD24F78D",
              "versionEndIncluding": "0.32.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}