CVE-2015-6420 Insecure Deserialization in Apache Commons Collection
Remote attackers can execute arbitrary commands on various Cisco products via crafted serialized Java objects exploiting the Apache Commons Collections library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-6420?
CVE-2015-6420 is a critical unsafe deserialization vulnerability in n/a, published on 15 Dec 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
Weakness: CWE-502
Which versions are affected by CVE-2015-6420?
10 open source packages ship an affected version, including commons-collections:commons-collections, net.sourceforge.collections:collections-generic and org.apache.commons:commons-collections4. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
commons-collections:commons-collections Maven | All versions | 3.2.2 |
commons-collections:commons-collections Maven | All versions | 3.2.2 |
net.sourceforge.collections:collections-generic Maven | All versions to 4.0.1 | None |
net.sourceforge.collections:collections-generic Maven | All versions to 4.0.1 | None |
org.apache.commons:commons-collections4 Maven | All versions | 4.1 |
org.apache.commons:commons-collections4 Maven | All versions | 4.1 |
4 more packages
org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic Maven | All versions to 4.01 | None |
org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic Maven | All versions to 4.01 | None |
org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections Maven | All versions to 3.2.1 | None |
org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections Maven | All versions to 3.2.1 | None |
Products include Apache Commons Collections.
How do I fix CVE-2015-6420?
Upgrade commons-collections:commons-collections to 3.2.2 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2015-6420 being exploited?
There is no known exploitation of CVE-2015-6420 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as CLSA-2026-1777509604, CLSA-2026-1778114665, CLSA-2026-1789362482, GHSA-6hgm-866r-3cjv, ROOT-APP-MAVEN-CVE-2015-6420.