Vulnerability Details CVE-2016-3642
The RMI service in SolarWinds Virtualization Manager 6.3.1 and earlier allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.235
EPSS Ranking 95.6%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 10.0
References
- http://packetstormsecurity.com/files/137486/Solarwinds-Virtualization-Manager-6.3.1-Java-Deserialization.html
- http://seclists.org/fulldisclosure/2016/Jun/25
- http://seclists.org/fulldisclosure/2016/Jun/29
- http://packetstormsecurity.com/files/137486/Solarwinds-Virtualization-Manager-6.3.1-Java-Deserialization.html
- http://seclists.org/fulldisclosure/2016/Jun/25
- http://seclists.org/fulldisclosure/2016/Jun/29
Products affected by CVE-2016-3642
-
cpe:2.3:a:solarwinds:virtualization_manager:6.3.1