Security readout for executives and security teams
Plain-English summary
A user who already has limited local access to a Linux system may exploit an unsafe temporary-file operation in ABRT to gain higher privileges. Successful exploitation could provide full control over system data and availability. The flaw affects ABRT versions before 2.7.1.
Executive priority
Treat as a high-priority privilege-escalation issue because CISA reports known exploitation. Remediate vulnerable multi-user, externally exposed, or previously compromised systems first. The local-access requirement reduces immediate remote risk but substantially increases the impact of an initial foothold.
Technical view
The abrt-hook-ccpp help program uses a predictably named file in an unsafe manner, enabling a local symlink attack. An eligible low-privileged user can redirect privileged file operations and escalate privileges. The CVSS 3.1 score is 7.8, with high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is limited to systems running ABRT before 2.7.1 where a local user has the required permissions. Network-only attackers cannot directly exploit this flaw. Distribution-specific affected packages and backported fix versions are not identified in the supplied evidence.
Exploitation context
CISA lists CVE-2015-5287 in its Known Exploited Vulnerabilities catalog, supporting active exploitation in the wild. A public Exploit-DB entry also exists. Exploitation requires prior local access and suitable permissions, making this primarily a post-compromise privilege-escalation risk.
Researcher notes
The weakness is CWE-59: improper link resolution before file access. The supplied record demonstrates predictable filenames under /var/tmp/abrt and /var/spool/abrt. Exact affected distribution releases, required permission sets, exploitation prevalence, and vendor backport versions are not established by the bundle.
Mitigation direction
- Upgrade ABRT to 2.7.1 or a vendor-supported package containing the fix.
- Consult the operating-system vendor for distribution-specific fixed package versions.
- Restrict local account access and permissions until remediation is complete.
- Prioritize internet-facing or multi-user systems where attackers could obtain initial access.
Validation and detection
- Inventory systems with ABRT installed and record package versions.
- Confirm whether installed packages predate ABRT 2.7.1 or lack the vendor backport.
- Verify the vendor advisory identifies the deployed package as fixed.
- Review local access paths and accounts holding permissions needed to invoke the vulnerable behavior.
- Investigate suspicious predictable-name files under ABRT temporary or spool directories.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-59: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2015-5287 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2015-5287 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-08-26T00:00:00.000Z: CVE-2015-5287 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- 38832CVE reference, redhat · exploit, x_refsource_EXPLOIT-DB
- https://bugzilla.redhat.com/show_bug.cgi?id=1266837CVE reference, redhat · x_refsource_CONFIRM
- https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740eCVE reference, redhat · x_refsource_CONFIRM
- https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/CVE reference, CISA-ADP · third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5287CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Link Resolution Before File Access ('Link Following')
Improper Link Resolution Before File Access ('Link Following') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.