CVE-2015-7450
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply updates per vendor instructions.
A flaw in how IBM products handle serialized Java objects allows attackers to run arbitrary commands on a server. This happens because the products use an unsafe library component that doesn't properly validate incoming data.
Remote attackers can exploit insecure deserialization of Java objects via the InvokerTransformer class in Apache Commons Collections to achieve remote code execution. The attack requires no authentication and can be triggered by sending a crafted serialized object to affected IBM products, resulting in complete system compromise.
The full analysis of this CVE is available in Portuguese →