-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| commons-collections:commons-collections | maven | < 3.2.2 | 3.2.2 |
| org.apache.commons:commons-collections4 | maven | < 4.1 | 4.1 |
| org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections | maven | >= 3.2.1, < 3.2.2 | |
| net.sourceforge.collections:collections-generic | maven | = 4.01 | |
| org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic | maven | >= 4.01, < 4.02 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unsafe deserialization of classes in Apache Commons Collections' functors package. InvokerTransformer, InstantiateFactory, and InstantiateTransformer are explicitly named in advisories (CVE-2015-7501, COLLECTIONS-580) as having dangerous serialization behavior. These classes allow method invocation and object instantiation via reflection, which attackers exploit by crafting malicious serialized object chains. The Apache project patched this by disabling serialization for these classes in versions 3.2.2/4.1, and Red Hat's documentation confirms their role in the exploit.