CVE-2017-15708

🗓️ 11 Dec 2017 15:00:00Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 208 Views

Apache Synapse 3.0.1 allows remote code execution via RM

Reporter	Title	Published	Views	Family All 33
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	8 Jun 202321:56	–	ibm
IBM Security Bulletins	Security Bulletin: The IBM® Engineering Lifecycle Management is impacted by vulnerabilties in Apache Commons Collections	18 Oct 202401:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Global Mailbox is vulnerable to arbitrary code execution due to Apache Commons Collections [CVE-2015-6420, CVE-2017-15708]	21 Jul 202312:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Jazz for Service Management (JazzSM) is affected with multiple vulnerabilities (CVE-2015-4852, CVE-2015-6420, CVE-2017-15708)	20 Oct 202011:33	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Commons Collections, Apache Synapse, Oracle WebLogic Server, MuleSoft and Red Hat JBoss might affect IBM Storage Copy Data Management.	24 Jan 202519:11	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities of Apache common collections (commons-collections-3.2.jar) have affected APM WebSphere Application Server Agent	17 Jul 202306:26	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of Apache Commons, IBM Operations Analytics - Log Analysis is affected by Improper Handling of Untrusted Input During Deserialization	9 Oct 202506:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Privileged Identity Manager is affected by multiple security vulnerabilities	19 Aug 201920:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to arbitrary code execution due to use of Apache Commons Collections (multiple vulnerabilities)	22 Nov 202216:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to security vulnerability	19 Jul 201916:20	–	ibm

NVD

Vulners

Node

apache synapseMatch1.0

apache synapseMatch1.1

apache synapseMatch1.1.1

apache synapseMatch1.1.2

apache synapseMatch1.2

apache synapseMatch2.0.0

apache synapseMatch2.1.0

apache synapseMatch3.0.0

Node

oracle financial_services_market_risk_measurement_and_managementMatch8.0.6

oracle financial_services_market_risk_measurement_and_managementMatch8.0.8

oracle peoplesoft_enterprise_peopletoolsMatch8.56

oracle peoplesoft_enterprise_peopletoolsMatch8.57

[
  {
    "product": "Apache Synapse",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "3.0.0"
      },
      {
        "status": "affected",
        "version": "2.1.0"
      },
      {
        "status": "affected",
        "version": "2.0.0"
      },
      {
        "status": "affected",
        "version": "1.2"
      },
      {
        "status": "affected",
        "version": "1.1.2"
      },
      {
        "status": "affected",
        "version": "1.1.1"
      }
    ]
  }
]

Source	Link
oracle	www.oracle.com/security-alerts/cpujul2020.html
oracle	www.oracle.com/security-alerts/cpujan2020.html
lists	www.lists.apache.org/thread.html/77f2accf240d25d91b47033e2f8ebec84ffbc6e6627112b2f98b66c9%40%3Cdev.synapse.apache.org%3E
security	www.security.gentoo.org/glsa/202107-37
securityfocus	www.securityfocus.com/bid/102154
lists	www.lists.apache.org/thread.html/r0fb289cd38c915b9a13a3376134f96222dd9100f1ef66b41631865c6%40%3Ccommits.doris.apache.org%3E

13 May 2026 00:24Current

9.7High risk

Vulners AI Score9.7

CVSS 27.5

CVSS 3.19.8

EPSS0.19899

CWE-74