High severity · published Dec 21, 2015
CVE-2015-6934
Serialized-object interfaces in VMware vRealize Orchestrator 6.x, vCenter Orchestrator 5.x, vRealize Operations 6.x, vCenter Operations 5.x, and vCenter Application Discovery…
7.3
CVSS
5%
EPSS
No
On KEV
Description
Serialized-object interfaces in VMware vRealize Orchestrator 6.x, vCenter Orchestrator 5.x, vRealize Operations 6.x, vCenter Operations 5.x, and vCenter Application Discovery Manager (vADM) 7.x allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.0% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VO
Vcenter Orchestrator · Vmware
5.5; 5.5.1; 5.5.2; 5.5.2.1 · source: NVD
VO
Vrealize Orchestrator · Vmware
6.0.1; 6.0.2; 6.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-6934
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-6934
www.securityfocus.com
http://www.securityfocus.com/bid/79648
Vendor Advisory
http://www.vmware.com/security/advisories/VMSA-2015-0009.html
More from Vcenter Orchestrator
–
CVE-2012-1513
The Web Configuration tool in VMware vCenter Orchestrator (vCO) 4.0 before Update 4, 4.1 before Update 2, and 4.2 before Update 1 places the vCenter Server password in an HTML…