CVE-2015-4902 is an unspecified integrity vulnerability in Oracle Java SE versions 6u101, 7u85, and 8u60, specifically impacting the Deployment component, and affecting products from vendors like openSUSE, Oracle, Red Hat, and SUSE. With a CVSS score of 5.3 (Medium), this vulnerability allows remote attackers to compromise data integrity without requiring user interaction, though the exact attack vectors are unknown. This flaw has been actively exploited in the wild, as indicated by its presence in the KEV catalog and media coverage linking it to the "Pawn Storm" attackers, despite a lack of public exploit code in Metasploit, Nuclei, or ExploitDB. The vulnerability garnered significant community discussion and media attention at the time of its discovery.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.6.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.6.0:update101:*:*:*:*:*:* | ||
1.7.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.7.0:update85:*:*:*:*:*:* | ||
1.8.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.8.0:update60:*:*:*:*:*:* | ||
1.6.0CPE matchmatch criteria | cpe:2.3:a:oracle:jre:1.6.0:update101:*:*:*:*:*:* | ||
1.7.0CPE matchmatch criteria | cpe:2.3:a:oracle:jre:1.7.0:update85:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:N/I:P/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.