diff --git a/CVE-2015-7501/README.md b/CVE-2015-7501/README.md index 1011251..2e5e8f2 100644 --- a/CVE-2015-7501/README.md +++ b/CVE-2015-7501/README.md @@ -3,7 +3,7 @@ The payload and test used is based on [ysoserial](https://github.com/frohoff/ysoserial), `ysoserial.payloads.CommonsCollections5.java`. - +Requires JDK 8. Succeeds (indicating vulnerability) at `3.2.1`; fails (indicating no vulnerability) at `3.2.2`. diff --git a/CVE-2015-7501/pov-project.json b/CVE-2015-7501/pov-project.json new file mode 100644 index 0000000..b976682 --- /dev/null +++ b/CVE-2015-7501/pov-project.json @@ -0,0 +1,25 @@ +{ + "id": "CVE-2015-7501", + "artifact": "commons-collections:commons-collections", + "vulnerableVersions": [ + "1.0", + "2.0", + "2.0.20020914.015953", + "2.0.20020914.020746", + "2.0.20020914.020858", + "2.1", + "2.1.1", + "3.0", + "3.0-dev2", + "3.1", + "3.2", + "3.2.1" + ], + "fixVersion": "3.2.2", + "jdkVersion": "8", + "testSignalWhenVulnerable": "success", + "references": [ + "https://nvd.nist.gov/vuln/detail/CVE-2015-7501", + "https://github.com/advisories/GHSA-fjq5-5j5f-mvxh" + ] +}