PT-2016-4944 · Apache+1 · Apache Commons Collections+1

Published 2016-02-12 · Updated 2016-12-01 · CVE-2016-1986

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HP Continuous Delivery Automation (CDA) version 1.30

Description The issue allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

Recommendations For HP Continuous Delivery Automation (CDA) version 1.30, consider disabling the use of the Apache Commons Collections library as a temporary workaround until a patch is available.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2016-1986

Affected Products

Apache Commons Collections

Hp Continuous Delivery Automation

References · 3

• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04958567 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1986 · Security Note
• https://osv.dev/vulnerability/CVE-2016-1986 · Vendor Advisory