CVE-2017-15708 in the critical feed json
Remote Code Execution in Apache Synapse
published 2017-12-11 8 y ago modified 2026-06-17 4 mo ago also GHSA-p694-23q3-rvrc , EUVD-2020-1465
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 17.9%
- EPSS 17.9% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.
Patch / fix
- maven org.apache.synapse:synapse-core 3.0.1
Exploit prediction
17.88% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.synapse:synapse-core | <3.0.1 |
3.0.1 |
Affected products
- Apache Software Foundation Apache Synapse
Classification
References
-
security.gentoo.org
/glsa/202107-37
vendor-advisory, web, third-party-advisory
-
securityfocus.com
/bid/102154
vdb-entry, web, third-party-advisory
-
lists.apache.org
/thread.html/77f2accf240d25d91b47033e2f8ebec84ffbc6e6627112b2f98b66c9%40%3Cdev.synapse.apache.org%3E
mailing-list
-
oracle.com
/security-alerts/cpujul2020.html
web, third-party-advisory
-
oracle.com
/security-alerts/cpujan2020.html
web, third-party-advisory
-
lists.apache.org
/thread.html/r0fb289cd38c915b9a13a3376134f96222dd9100f1ef66b41631865c6%40%3Ccommits.doris.apache.org%3E
mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2017-15708
advisory
-
lists.apache.org
/thread.html/77f2accf240d25d91b47033e2f8ebec84ffbc6e6627112b2f98b66c9@%3Cdev.synapse.apache.org%3E
web
-
lists.apache.org
/thread.html/r0fb289cd38c915b9a13a3376134f96222dd9100f1ef66b41631865c6@%3Ccommits.doris.apache.org%3E
web
Sources
- CVE List CVE-2017-15708
- GitHub Advisory GHSA-p694-23q3-rvrc
- NVD CVE-2017-15708
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.