CVE-2015-6934

Published: Dec 21, 2015Modified: May 6, 2026

7.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 3.9 / Impact: 3.4

Source: NVD

Description

Serialized-object interfaces in VMware vRealize Orchestrator 6.x, vCenter Orchestrator 5.x, vRealize Operations 6.x, vCenter Operations 5.x, and vCenter Application Discovery Manager (vADM) 7.x allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

Affected (7)

Products: Vmware: Vcenter Orchestrator, Vrealize Orchestrator

Vmware

2 products

Vcenter Orchestrator

Vrealize Orchestrator

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Vmware Vcenter Orchestrator	Version 5.5.1
Vmware Vcenter Orchestrator	Version 5.5.2.1
Vmware Vcenter Orchestrator	Version 5.5.2
Vmware Vcenter Orchestrator	Version 5.5
Vmware Vrealize Orchestrator	Version 6.0.1
Vmware Vrealize Orchestrator	Version 6.0.2
Vmware Vrealize Orchestrator	Version 6.0.3

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

http://www.securityfocus.com/bid/79648

Source: cve@mitre.org

http://www.vmware.com/security/advisories/VMSA-2015-0009.html

Source: cve@mitre.org

Vendor Advisory

http://www.securityfocus.com/bid/79648

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vmware.com/security/advisories/VMSA-2015-0009.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.