CVE-2015-6420
Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
- CVSS 3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 15% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-25)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:commons_collections
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6hgm-866r-3cjv | Maven | org.apache.commons:commons-collections4 | <4.1 | 4.1 |
| GHSA-6hgm-866r-3cjv | Maven | commons-collections:commons-collections | <3.2.2 | 3.2.2 |
| GHSA-6hgm-866r-3cjv | Maven | net.sourceforge.collections:collections-generic | <=4.0.1 | no fix published |
| GHSA-6hgm-866r-3cjv | Maven | org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic | <=4.01 | no fix published |
| GHSA-6hgm-866r-3cjv | Maven | org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections | <=3.2.1 | no fix published |
References
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.securityfocus.com/bid/78872
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722