CVEvulnerability

CVE-2015-6934

7.3 HIGH Published 2015-12-21 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2015-12-21
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.3 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-20

Description

Serialized-object interfaces in VMware vRealize Orchestrator 6.x, vCenter Orchestrator 5.x, vRealize Operations 6.x, vCenter Operations 5.x, and vCenter Application Discovery Manager (vADM) 7.x allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

Affected configurations

• vmware vcenter orchestrator 5.5 • vmware vcenter orchestrator 5.5.1 • vmware vcenter orchestrator 5.5.2 • vmware vcenter orchestrator 5.5.2.1 • vmware vrealize orchestrator 6.0.1 • vmware vrealize orchestrator 6.0.2 • vmware vrealize orchestrator 6.0.3

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References