CVE-2015-8400: Fedoraproject Fedora

High severity, CVSS 7.4. EPSS: 2% chance of exploitation in the next 30 days.

The HTTPS fallback implementation in Shell In A Box (aka shellinabox) before 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the "/plain" URL.

Affected products

• Fedoraproject Fedora: version 22 only; version 23 only
• Shellinabox Project Shellinabox: up to and including 2.18

Published 2016-01-12. Last modified 2026-06-17.