commons-collections:commons-collections@2.0.20020914.020746 vulnerabilities

commons-collections:commons-collections is a library which contains types that extend and augment the Java Collections Framework.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. Versions of commons-collections prior to 3.2.2 do not prevent deserialization of the class org.apache.commons.collections.functors.InvokerTransformer. This could be leveraged by an attacker as a gadget within a vulnerable application which deserializes user input to execute arbitrary code.

Versions of commons-collections from 3.2.2 onwards will throw an UnsupportedOperationException error when attempts are made to deserialize InvokerTransformer instances to prevent potential remote code execution exploits.

Note: org.apache.commons:commons-collections is no longer supported and has been moved to org.apache.commons:commons-collections4 we recommend moving to the new artifact if possible.

Upgrade commons-collections:commons-collections to version 3.2.2 or higher.