Vulnerability Description
Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Commons Collections | >= 3.0, < 3.2.2 |
Related Weaknesses (CWE)
References
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlThird Party Advisory
- http://www.securityfocus.com/bid/78872Third Party AdvisoryVDB Entry
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-cThird Party Advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-cThird Party Advisory
- https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bcVendor Advisory
- https://www.kb.cert.org/vuls/id/581311Third Party Advisory
- https://www.tenable.com/security/research/tra-2017-14Third Party Advisory
- https://www.tenable.com/security/research/tra-2017-23Third Party Advisory
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlThird Party Advisory
- http://www.securityfocus.com/bid/78872Third Party AdvisoryVDB Entry
- https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkinsExploitThird Party Advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-cThird Party Advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-cThird Party Advisory
FAQ
What is CVE-2015-6420?
CVE-2015-6420 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices...
How severe is CVE-2015-6420?
CVE-2015-6420 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2015-6420?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Commons Collections.