Read the docs
TI-2017-11481 Aliases CVE-2017-15708GHSA-p694-23q3-rvrc

Injection in Apache Synapse

Priority MEDIUM 59CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.

Why it matters now

EPSS 0.1788 97th percentileScored 2026-11-07
Fix Fixed org.apache.synapse:synapse-core (Maven): 3.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Synapse3.0.0; 2.1.0; 2.0.0; 1.2; 1.1.2; 1.1.1—No fix listedCNA
—org.apache.synapse:synapse-core (Maven)before 3.0.13.0.1Patch availableGHSA-p694-23q3-rvrc
  • Apache Synapse VendorApache Affected 3.0.0; 2.1.0; 2.0.0; 1.2; 1.1.2; 1.1.1 Fixed in — No fix listed CNA
  • org.apache.synapse:synapse-core (Maven) Vendor— Affected before 3.0.1 Fixed in 3.0.1 Patch available GHSA-p694-23q3-rvrc

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:apache:synapse:1.0:*:*:*:*:*:*:*1.0VulnerableApache
cpe:2.3:a:apache:synapse:1.1:*:*:*:*:*:*:*1.1VulnerableApache
cpe:2.3:a:apache:synapse:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableApache
cpe:2.3:a:apache:synapse:1.1.2:*:*:*:*:*:*:*1.1.2VulnerableApache
cpe:2.3:a:apache:synapse:1.2:*:*:*:*:*:*:*1.2VulnerableApache
cpe:2.3:a:apache:synapse:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableApache
cpe:2.3:a:apache:synapse:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableApache
cpe:2.3:a:apache:synapse:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableApache
cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*8.0.6VulnerableOracle
cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:*8.0.8VulnerableOracle
  • cpe:2.3:a:apache:synapse:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:synapse:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:synapse:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:synapse:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:synapse:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:synapse:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:synapse:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:synapse:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Apache
  • cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:* Versions 8.0.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* Versions 8.0.8 Vulnerable ·Oracle
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*8.56VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*8.57VulnerableOracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* Versions 8.56 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-p694-23q3-rvrc org.apache.synapse:synapse-core (Maven) Fixed in 3.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-15708
  2. 2026-10-03 Alias added: GHSA-p694-23q3-rvrc

References

Advisory 4

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences