$ cve CVE-2015-1793 JSON

CVE-2015-1793 EXPLOIT

6.5

MEDIUM · CVSS 3.0 · EPSS 62.4% (pctl 99)

Patch early

A public exploit exists.

Description

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.

Scoring

CVSS	6.5 (MEDIUM, v3.0)
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS	62.39% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-254
On CISA KEV	no
Public exploit	yes
Published	2015-07-09
Last modified	2026-06-17

Affected (4)

Vendor	Product
openssl	openssl
oracle	jd edwards enterpriseone tools
oracle	opus 10g ethernet switch family
oracle	supply chain products suite

Public exploits

Source	Title	Date
exploit-db	OpenSSL - Alternative Chains Certificate Forgery	2015-11-05

References

→ the Explorer · watch your stack · NVD