What is CVE-2015-6420?

CVE-2015-6420 is a critical-severity vulnerability in Apache Commons Collections, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2015-12-15.

How severe is CVE-2015-6420?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2015-6420 known to be exploited?

35 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Deserialization in Apache Commons Collections

CVE-2015-6420

Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Vulnerability class: Insecure Deserialization

EPSS: 0.181 (96.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Apache Commons_collections — versions 4.0
N/a — versions n/a

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

Public proof-of-concept exploits

References

psirt@cisco.com (x_refsource_CONFIRM, Third Party Advisory)
psirt@cisco.com (x_refsource_CONFIRM, Third Party Advisory)
psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Third Party Advisory)
psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
psirt@cisco.com (Third Party Advisory, x_refsource_MISC)
psirt@cisco.com (x_refsource_CONFIRM, Third Party Advisory)
psirt@cisco.com (x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)
psirt@cisco.com (Third Party Advisory, x_refsource_MISC)
psirt@cisco.com (Vendor Advisory, mailing-list, x_refsource_MLIST)
af854a3a-2127-422b-91ae-364da2661108 (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2015-6420?: CVE-2015-6420 is a critical-severity vulnerability in Apache Commons Collections, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2015-12-15.
How severe is CVE-2015-6420?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2015-6420 known to be exploited?: 35 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.