Vulnerability Details : CVE-2015-6127
Public exploit exists!
Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers to read arbitrary files via a crafted .mcl file, aka "Windows Media Center Information Disclosure Vulnerability."
Vulnerability category: Information leak
Products affected by CVE-2015-6127
- cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-6127
81.94%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2015-6127
-
MS15-134 Microsoft Windows Media Center MCL Information Disclosure
Disclosure Date: 2015-12-08First seen: 2020-04-26auxiliary/server/ms15_134_mcl_leakThis module exploits a vulnerability found in Windows Media Center. It allows an MCL file to render itself as an HTML document in the local machine zone by Internet Explorer, which can be used to leak files on the target machine. Please be aware that if this exploit
CVSS scores for CVE-2015-6127
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2015-6127
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-6127
-
http://www.securityfocus.com/bid/78516
Microsoft Windows CVE-2015-6127 Information Disclosure VulnerabilityThird Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1034335
Windows Media Center '.mcl' File Processing Flaw Lets Remote Users Execute Arbitrary C ode - SecurityTrackerThird Party Advisory;VDB Entry
-
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-134
Microsoft Security Bulletin MS15-134 - Important | Microsoft DocsPatch;Vendor Advisory
-
https://www.exploit-db.com/exploits/38912/
Microsoft Windows Media Center - '.Link' File Incorrectly Resolved Reference (MS15-134)Exploit;Third Party Advisory;VDB Entry
Jump to