Unscored severity · published Jun 9, 2015
CVE-2015-4335
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command
–
CVSS
9.5%
EPSS
No
On KEV
Description
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
Exploitation
Is it being used?
Exploit prediction (EPSS)9.5% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Redis · Redis
through 2.8.20; 3.0.0; 3.0.1 · source: NVD
DL
Debian Linux · Debian
8.0; 9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-4335
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-4335
Exploit
http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162094.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162146.html
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-10/msg00014.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1676.html
Third Party Advisory
http://www.debian.org/security/2015/dsa-3279
More from Redis
10.0
CVE-2022-0543
Debian-specific Redis Server Lua Sandbox Escape Vulnerability
9.9
CVE-2025-49844
Redis Lua Use-After-Free may lead to remote code execution
9.8
CVE-2025-27151
redis-check-aof may lead to stack overflow and potential RCE
9.8
CVE-2024-46981
Redis' Lua library commands may lead to remote code execution
9.8
CVE-2022-3734
Redis on Windows dbghelp.dll uncontrolled search path