9.3crit
CVE-2016-15044
Kaltura < 11.1.0-2 PHP Object Injection RCE
Published 15 mo ago · modified 3 mo ago · JSON
CVSS
9.3
v4.0 · CNA
CISA KEV
No
not known exploited
EPSS
2.4%
percentile 84%
Public exploits
0
none known
Summary
A remote code execution vulnerability exists in Kaltura versions prior to 11.1.0-2 due to unsafe deserialization of user-controlled data within the keditorservices module. An unauthenticated remote attacker can exploit this issue by sending a specially crafted serialized PHP object in the kdata GET parameter to the redirectWidgetCmd endpoint. Successful exploitation leads to execution of arbitrary PHP code in the context of the web server process.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 15 mo ago
Exploit prediction (EPSS)
2.38% probability of exploitation in the next 30 days, higher than 84% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Kaltura Video Platform
Classification
References
- raw.githubusercontent.com /rapid7/metasploit-framework/master/modules/exploits/linux/http/kaltura_unserialize_rce.rb · exploit
- exploit-db.com /exploits/39563 · exploit
- exploit-db.com /exploits/40404 · exploit
- vulncheck.com /advisories/kaltura-php-object-injection-rce · third-party-advisory
Sources
- CVE List: CVE-2016-15044
- NVD: CVE-2016-15044
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.