CVE-2017-15708

Published Dec 11, 2017

Last updated a year ago

CVSS critical 9.8

Overview

Description: In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.
Source: security@apache.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

CVSS 2.0

Type: Primary
Base score: 7.5
Impact score: 6.4
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-74

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:synapse:1.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B2CDE3B8-4925-4432-A392-91FE14E26A5F"
          },
          {
            "criteria": "cpe:2.3:a:apache:synapse:1.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FDEA6B13-3CAE-4062-9204-039176C4C5C4"
          },
          {
            "criteria": "cpe:2.3:a:apache:synapse:1.1.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7647E5A8-F6A3-465E-8269-DACD7D69D9BE"
          },
          {
            "criteria": "cpe:2.3:a:apache:synapse:1.1.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "458A586F-9BC5-4B12-8700-9162B1A90516"
          },
          {
            "criteria": "cpe:2.3:a:apache:synapse:1.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CEF877C1-C68B-416D-9F8C-488AC8473625"
          },
          {
            "criteria": "cpe:2.3:a:apache:synapse:2.0.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A110F340-084D-463A-8EF0-48B743EA8741"
          },
          {
            "criteria": "cpe:2.3:a:apache:synapse:2.1.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D7ACC01A-13FE-4E89-8C0A-572EE3E3863C"
          },
          {
            "criteria": "cpe:2.3:a:apache:synapse:3.0.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "32D8CFF0-B33B-4544-BB41-C2A4B373E186"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EF6D5112-4055-4F89-A5B3-0DCB109481B7"
          },
          {
            "criteria": "cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D262848E-AA24-4057-A747-6221BA22ADF4"
          },
          {
            "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D0A735B4-4F3C-416B-8C08-9CB21BAD2889"
          },
          {
            "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7E1E416B-920B-49A0-9523-382898C2979D"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Social media

Configurations

References