## https://sploitus.com/exploit?id=AAC09C36-9DDA-5852-9057-3218BE2F097A
CVE-2020-2555 is a remote code execution (RCE) vulnerability in Oracle WebLogic Server. It is caused by a deserialization bug in the com.tangosol.util.extractor.ReflectionExtractor class. The vulnerability allows an attacker to execute arbitrary code on the server by sending a specially crafted request.
The vulnerability is present in WebLogic Server versions 12.2.1.0.0, 12.2.1.1.0, 12.2.1.2.0, and 14.1.1.0.0. It is not present in version 14.1.1.1.0.
To exploit the vulnerability, an attacker needs to send a request to the server with a specially crafted payload. The payload should be a serialized Java object that contains a malicious ReflectionExtractor object. When the server deserializes the object, it will execute the malicious code.
The vulnerability was discovered by a security researcher and reported to Oracle. Oracle has released a patch to fix the vulnerability.
In this context, the provided code snippets are from the commons-collections library, which is used by WebLogic Server. The code snippets show the implementation of the Bag and BagUtils classes, which are related to the deserialization bug.
The execution