apache commons-collections CVE-2017-15708 in Apache and Oracle Products
Published on December 11, 2017

product logo product logo
In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.

Vendor Advisory NVD


Products Associated with CVE-2017-15708

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2017-15708 are published in these products:

Apache Commons Collections
 
Apache Synapse
 
Oracle Financial Services Market Risk Measurement Management
 
Oracle Peoplesoft Enterprise Peopletools
 

Affected Versions

Apache Software Foundation Apache Synapse:

Exploit Probability

EPSS
19.90%
Percentile
95.33%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.