CVE-2015-6934 — HIGH (7.3) — White Hats Nepal

Vulnerability Description

Serialized-object interfaces in VMware vRealize Orchestrator 6.x, vCenter Orchestrator 5.x, vRealize Operations 6.x, vCenter Operations 5.x, and vCenter Application Discovery Manager (vADM) 7.x allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

CVSS Score

7.3

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Vmware	Vcenter Orchestrator	5.5
Vmware	Vrealize Orchestrator	6.0.1

Related Weaknesses (CWE)

CWE-20

References

FAQ

What is CVE-2015-6934?

CVE-2015-6934 is a vulnerability with a CVSS score of 7.3 (HIGH). Serialized-object interfaces in VMware vRealize Orchestrator 6.x, vCenter Orchestrator 5.x, vRealize Operations 6.x, vCenter Operations 5.x, and vCenter Application Discovery Manager (vADM) 7.x allow ...

How severe is CVE-2015-6934?

CVE-2015-6934 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2015-6934?

Check the references section above for vendor advisories and patch information. Affected products include: Vmware Vcenter Orchestrator, Vmware Vrealize Orchestrator.