CVE-2016-15044: Kaltura < 11.1.0-2 PHP Object Injection RCE
A remote code execution vulnerability exists in Kaltura versions prior to 11.1.0-2 due to unsafe deserialization of user-controlled data within the keditorservices module. An unauthenticated remote attacker can exploit this issue by sending a specially crafted serialized PHP object in the kdata GET parameter to the redirectWidgetCmd endpoint. Successful exploitation leads to execution of arbitrary PHP code in the context of the web server process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kalturato a version that resolves this vulnerability.Fixed in 11.1.0-2
Event History
Frequently Asked Questions
What is the severity of CVE-2016-15044?
CVE-2016-15044 is classified as a critical severity remote code execution vulnerability.
How do I fix CVE-2016-15044?
To mitigate CVE-2016-15044, upgrade Kaltura to version 11.1.0-2 or later.
What systems are affected by CVE-2016-15044?
CVE-2016-15044 affects Kaltura versions prior to 11.1.0-2.
What can an attacker do if they exploit CVE-2016-15044?
An attacker exploiting CVE-2016-15044 can execute arbitrary code remotely on the affected Kaltura instance.
Is user authentication required to exploit CVE-2016-15044?
No, CVE-2016-15044 can be exploited by unauthenticated remote attackers.