$ cve CVE-2017-15708 JSON

CVE-2017-15708

9.8

CRITICAL · CVSS 3.1 · EPSS 17.7% (pctl 97)

Patch early

EPSS 17.7% — above the 10% action threshold.

Description

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	17.74% — more likely to be exploited than 97% of all CVEs
Weakness	CWE-74
On CISA KEV	no
Public exploit	none known
Published	2017-12-11
Last modified	2026-06-17

Affected (3)

Vendor	Product
apache	synapse
oracle	financial services market risk measurement and management
oracle	peoplesoft enterprise peopletools

References

→ the Explorer · watch your stack · NVD