CVE-2015-6420CWE-502insecure-deserialization

CVE-2015-6420

Critical · published December 15, 2015

CVSS v3.1
9.8
EPSS
19%
Percentile
97.3
In the wild
Unconfirmed
What it is

Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.18763 · 97.3th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2015-12-15T10:59Z
Affected products (2)
ProductVersionsFixed in
apache/commons_collections≥ 3.0, < 3.2.23.2.2
apache/commons_collectionsall versions—
References (21)
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization · [email protected]http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · [email protected]http://www.securityfocus.com/bid/78872 · [email protected]https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917 · [email protected]https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 · [email protected]https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21%40%3Ccommits.samza.apache.org%3E · [email protected]https://www.kb.cert.org/vuls/id/581311 · [email protected]https://www.tenable.com/security/research/tra-2017-14 · [email protected]https://www.tenable.com/security/research/tra-2017-23 · [email protected]http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/78872 · af854a3a-2127-422b-91ae-364da2661108https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ · af854a3a-2127-422b-91ae-364da2661108https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917 · af854a3a-2127-422b-91ae-364da2661108https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21%40%3Ccommits.samza.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://news.apache.org/foundation/entry/apache_commons_statement_to_widespread · af854a3a-2127-422b-91ae-364da2661108https://www.kb.cert.org/vuls/id/576313 · af854a3a-2127-422b-91ae-364da2661108https://www.kb.cert.org/vuls/id/581311 · af854a3a-2127-422b-91ae-364da2661108https://www.tenable.com/security/research/tra-2017-14 · af854a3a-2127-422b-91ae-364da2661108https://www.tenable.com/security/research/tra-2017-23 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 15 DEC 02:00Z
    Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and…
    cvelistv5