CVE-2017-15708: Critical severity apache synapse vulnerability
In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-15708?
CVE-2017-15708 is a vulnerability in Apache Synapse that allows remote code execution attacks by injecting specially crafted serialized objects.
How severe is CVE-2017-15708?
CVE-2017-15708 has a severity rating of 9.8, which is considered critical.
Which versions of Apache Synapse are affected by CVE-2017-15708?
Apache Synapse versions 1.0, 1.1, 1.1.1, 1.1.2, 1.2, 2.0.0, 2.1.0, and 3.0.0 are all affected by CVE-2017-15708.
What is the impact of CVE-2017-15708?
CVE-2017-15708 allows remote code execution, which could lead to unauthorized access, data theft, or other malicious activities.
How can I mitigate CVE-2017-15708?
To mitigate CVE-2017-15708, it is recommended to apply the latest patches and updates provided by Apache Synapse.