$ cve CVE-2015-7450 JSON

CVE-2015-7450 KEV EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 97.8% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-07-10.

Description

Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	97.76% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-502
On CISA KEV	yes — remediate by 2022-07-10
Public exploit	yes
Published	2016-01-02
Last modified	2026-06-17

CISA KEV

Name	IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
Added	2022-01-10
Due	2022-07-10
Vendor / product	IBM / WebSphere Application Server and Server Hypervisor Edition
Ransomware use	none reported

Affected (7)

Vendor	Product
ibm	sterling b2b integrator
ibm	sterling integrator
ibm	tivoli common reporting
ibm	watson content analytics
ibm	watson explorer analytical components
ibm	watson explorer annotation administration console
ibm	websphere application server

Public exploits

Source	Title	Date
exploit-db	IBM WebSphere - RCE Java Deserialization (Metasploit)	2017-03-15

References

→ the Explorer · watch your stack · NVD