The vulnerability of the Apache Commons Collections library, related to the restoration of unreliable data in memory, allows attackers to execute arbitrary commands.

🗓️ 26 Dec 2017 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Apache Commons Collections flaw enables remote code execution via crafted serialized Java objects.

Reporter	Title	Published	Views	Family All 202
IBM Security Bulletins	Security Bulletin: Remediation of Multiple Apache Struts 1.1 Vulnerabilities in IBM Library Support for Struts	16 Jan 202609:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	8 Jun 202321:56	–	ibm
IBM Security Bulletins	Security Bulletin: The IBM® Engineering Lifecycle Management is impacted by vulnerabilties in Apache Commons Collections	18 Oct 202401:43	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Commons Collections, Apache Synapse, Oracle WebLogic Server, MuleSoft and Red Hat JBoss might affect IBM Storage Copy Data Management.	24 Jan 202519:11	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of Apache Commons, IBM Operations Analytics - Log Analysis is affected by Improper Handling of Untrusted Input During Deserialization	9 Oct 202506:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Privileged Identity Manager is affected by multiple security vulnerabilities	19 Aug 201920:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to arbitrary code execution due to use of Apache Commons Collections (multiple vulnerabilities)	22 Nov 202216:37	–	ibm
IBM Security Bulletins	Security Bulletin: Remediation of Multiple Apache Struts Vulnerabilities in IBM Library Support for Struts	13 Mar 202617:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965)	11 Apr 202215:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Controller	13 Aug 202512:05	–	ibm

Vulners

Node

red_hat openshiftRange3.0≥

red_hat jboss_enterprise_application_platformRange5.0≥

red_hat jboss_enterprise_application_platformRange6.0≥

red_hat xpaasRange3.0≥

red_hat jboss_a-mqRange6.0≥

red_hat jboss_enterprise_application_platformRange4.3.0≥

red_hat jboss_soa_platformRange5.0≥

red_hat jboss_fuse_service_worksRange6.0≥

red_hat subscription_asset_managerMatch1.3

red_hat jboss_portalRange6.0≥

red_hat jboss_operations_networkRange3.0≥

red_hat jboss_fuseRange6.0≥

red_hat jboss_web_serverRange3.0≥

red_hat jboss_brmsRange5.0≥

red_hat jboss_brmsRange6.0≥

red_hat jboss_bpm_suiteRange6.0≥

red_hat data_gridRange6.0≥

oracle identity_managerMatch11.1.2.3.0

oracle retail_xstore_point_of_serviceMatch7.0

oracle retail_xstore_point_of_serviceMatch7.1

oracle oracle_retail_clearance_optimization_engineMatch14.0

oracle communications_performance_intelligence_center_(pic)_softwareRange<10.2.1

oracle rapid_planningMatch12.1

oracle rapid_planningMatch12.2

oracle identity_manager_connectorMatch9.0.4.20.6

oracle identity_manager_connectorMatch9.0.4.21.0

oracle identity_manager_connectorMatch9.0.4.25.4

oracle tape_library_acslsRange<8.4.0-3

oracle communications_application_session_controllerRange<3.7.1m0

oracle oracle_retail_clearance_optimization_engineMatch13.2

oracle oracle_retail_clearance_optimization_engineMatch13.3

oracle oracle_retail_clearance_optimization_engineMatch13.4

oracle retail_xstore_point_of_serviceMatch5.0

oracle retail_xstore_point_of_serviceMatch5.5

oracle retail_xstore_point_of_serviceMatch6.0

oracle retail_xstore_point_of_serviceMatch6.5

Source	Link
securityfocus	www.securityfocus.com/bid/78215
securitytracker	www.securitytracker.com/id/1034097
securitytracker	www.securitytracker.com/id/1037052
securitytracker	www.securitytracker.com/id/1037053
securitytracker	www.securitytracker.com/id/1037640
access	www.access.redhat.com/security/vulnerabilities/2059393
access	www.access.redhat.com/solutions/2045023
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
oracle	www.oracle.com/security-alerts/cpuoct2018.html
oracle	www.oracle.com/security-alerts/cpujul2018.html

02 Jun 2021 00:00Current

8.2High risk

Vulners AI Score8.2

CVSS 39.8

CVSS 210

EPSS0.83274