Log in Start free

Actively exploited · Published Jan 2, 2016 · Assigned by ibm

CVE-2015-7450

Critical 9.8 Exploited

In plain English

A critical-severity unsafe deserialization in WebSphere Application Server and Server Hypervisor Edition from IBM. Attackers are actively exploiting it in the wild (listed by CISA on January 10, 2022). The chance it is exploited in the next 30 days is estimated at 97.8% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)97.8%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since Jan 10, 2022
Attack tooling2Metasploit, Nuclei

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jul 10, 2022.

Official description

Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References