$ cve CVE-2015-4148 JSON

CVE-2015-4148 EXPLOIT

5.0

MEDIUM · CVSS 2.0 · EPSS 19.8% (pctl 97)

Patch early

A public exploit exists.

Description

The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a "type confusion" issue.

Scoring

CVSS	5.0 (MEDIUM, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS	19.83% — more likely to be exploited than 97% of all CVEs
Weakness	CWE-20
On CISA KEV	no
Public exploit	yes
Published	2015-06-09
Last modified	2026-06-17

Affected (8)

Vendor	Product
apple	mac os x
php	php
redhat	enterprise linux desktop
redhat	enterprise linux hpc node
redhat	enterprise linux hpc node eus
redhat	enterprise linux server
redhat	enterprise linux server eus
redhat	enterprise linux workstation

Public exploits

Source	Title	Date
exploit-db	SMF (Simple Machine Forum) 2.0.10 - Remote Memory Exfiltration	2015-09-24

References

→ the Explorer · watch your stack · NVD