CVE-2015-6420: Critical severity Apache Commons Collections vulnerability
Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
Other sources
Serialized-object interfaces in Java applications using the Apache Commons Collections (ACC) library may allow remote attackers to execute arbitrary commands via a crafted serialized Java object.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2015-6420?
CVE-2015-6420 is a vulnerability in Java applications using the Apache Commons Collections (ACC) library.
How severe is CVE-2015-6420?
CVE-2015-6420 has a severity rating of 9.8 (Critical).
Which software is affected by CVE-2015-6420?
The following software is affected by CVE-2015-6420: Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unif…
How do I fix CVE-2015-6420?
To fix CVE-2015-6420, update to Apache Commons Collections version 3.2.2 or above, or update to Apache Commons Collections4 version 4.1 or above.
What is the Common Weakness Enumeration (CWE) ID for CVE-2015-6420?
The CWE ID for CVE-2015-6420 is 502.