CVE-2015-8562: Input Validation
Published Dec 16, 2015
·Updated
Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.
Affected Software
95 affected components
Joomla Joomla\!=1.5.0
Joomla Joomla\!=1.5.1
Joomla Joomla\!=1.5.2
Joomla Joomla\!=1.5.3
Joomla Joomla\!=1.5.4
Joomla Joomla\!=1.5.6
Joomla Joomla\!=1.5.7
Joomla Joomla\!=1.5.8
Joomla Joomla\!=1.5.9
Joomla Joomla\!=1.5.10
Joomla Joomla\!=1.5.11
Joomla Joomla\!=1.5.12
Joomla Joomla\!=1.5.13
Joomla Joomla\!=1.5.14
Joomla Joomla\!=1.5.15
Joomla Joomla\!=1.5.16
Joomla Joomla\!=1.5.17
Joomla Joomla\!=1.5.18
Joomla Joomla\!=1.5.19
Joomla Joomla\!=1.5.20
Joomla Joomla\!=1.5.21
Joomla Joomla\!=1.5.22
Joomla Joomla\!=1.5.23
Joomla Joomla\!=1.5.24
Joomla Joomla\!=1.5.25
Joomla Joomla\!=1.5.26
Joomla Joomla\!=1.6.0
Joomla Joomla\!=1.6.1
Joomla Joomla\!=1.6.2
Joomla Joomla\!=1.6.3
Joomla Joomla\!=1.6.4
Joomla Joomla\!=1.6.5
Joomla Joomla\!=1.6.6
Joomla Joomla\!=1.7.0
Joomla Joomla\!=1.7.1
Joomla Joomla\!=1.7.2
Joomla Joomla\!=1.7.3
Joomla Joomla\!=1.7.4
Joomla Joomla\!=1.7.5
Joomla Joomla\!=2.5.0
Joomla Joomla\!=2.5.1
Joomla Joomla\!=2.5.2
Joomla Joomla\!=2.5.3
Joomla Joomla\!=2.5.4
Joomla Joomla\!=2.5.5
Joomla Joomla\!=2.5.6
Joomla Joomla\!=2.5.7
Joomla Joomla\!=2.5.8
Joomla Joomla\!=2.5.9
Joomla Joomla\!=2.5.10
Joomla Joomla\!=2.5.11
Joomla Joomla\!=2.5.12
Joomla Joomla\!=2.5.13
Joomla Joomla\!=2.5.14
Joomla Joomla\!=2.5.15
Joomla Joomla\!=2.5.16
Joomla Joomla\!=2.5.17
Joomla Joomla\!=2.5.18
Joomla Joomla\!=2.5.19
Joomla Joomla\!=2.5.20
Joomla Joomla\!=2.5.21
Joomla Joomla\!=2.5.22
Joomla Joomla\!=2.5.23
Joomla Joomla\!=2.5.24
Joomla Joomla\!=2.5.25
Joomla Joomla\!=2.5.26
Joomla Joomla\!=2.5.27
Joomla Joomla\!=2.5.28
Joomla Joomla\!=3.0.0
Joomla Joomla\!=3.0.1
Joomla Joomla\!=3.0.2
Joomla Joomla\!=3.0.3
Joomla Joomla\!=3.1.0
Joomla Joomla\!=3.1.1
Joomla Joomla\!=3.1.2
Joomla Joomla\!=3.1.3
Joomla Joomla\!=3.1.4
Joomla Joomla\!=3.1.5
Joomla Joomla\!=3.1.6
Joomla Joomla\!=3.2.0
Joomla Joomla\!=3.2.1
Joomla Joomla\!=3.2.2
Joomla Joomla\!=3.2.3
Joomla Joomla\!=3.2.4
Joomla Joomla\!=3.3.0
Joomla Joomla\!=3.3.1
Joomla Joomla\!=3.3.2
Joomla Joomla\!=3.3.3
Joomla Joomla\!=3.3.4
Joomla Joomla\!=3.4.0
Joomla Joomla\!=3.4.1
Joomla Joomla\!=3.4.2
Joomla Joomla\!=3.4.3
Joomla Joomla\!=3.4.4
Joomla Joomla\!=3.4.5
Event History
Dec 16, 2015
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-8562?
CVE-2015-8562 has a high severity rating due to its potential to allow remote code execution through PHP object injection.
2
How do I fix CVE-2015-8562?
To fix CVE-2015-8562, upgrade your Joomla installation to version 3.4.6 or later, as this version addresses the vulnerability.
3
Who is affected by CVE-2015-8562?
CVE-2015-8562 affects all Joomla installations from version 1.5.x to 3.4.5.
4
What types of attacks are possible with CVE-2015-8562?
CVE-2015-8562 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code.
5
When was CVE-2015-8562 first exploited?
CVE-2015-8562 was reported to be exploited in the wild in December 2015.