CVE-2015-4148
No CVSS score yet. EPSS 20% chance of exploitation in the next 30 days.
The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a "type confusion" issue.
- EPSS
- 20% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apple:mac_os_x
- php:php
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_hpc_node
- redhat:enterprise_linux_hpc_node_eus
- redhat:enterprise_linux_server
- redhat:enterprise_linux_server_eus
- redhat:enterprise_linux_workstation