SAP security note 2246851, "PI SEC: Security vulnerabilities found in Apache Commons Collections library used in Enterprise Services Repository". Below are the symptom and SAP recommended solution.
Description
Symptom
Enterprise Services Repository (ESR) uses a version of Apache Commons Collections, for which security vulnerabilities have been detected.
Solution
The vulnerabilities are fixed with the Support Packages and Patches referenced in this SAP Note. Please apply the relevant Support Package Patches for your specific ESR version to mitigate the security issues.
Reason and prerequisites
This SAP Note is only applicable if you are using Enterprise Services Repository.
References
Full note on SAP: SAP Support Launchpad note 2246851
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].