CVE-2015-7501

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Published: Nov 9, 2017
Updated: Feb 17, 2024
CVE: CVE-2015-7501
GHSA: GHSA-fjq5-5j5f-mvxh
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 10
AV:N/AC:L/Au:N/C:C/I:C/A:C

CWEs:

CWE-502

OWASP TOP 10:

A8 - Insecure Deserialization

Affected Software
References

Software	From	Fixed in
redhat / jboss_operations_network	3.0	3.0.x
redhat / jboss_a-mq	6.0.0	6.0.0.x
redhat / jboss_enterprise_application_platform	4.3.0	4.3.0.x
redhat / jboss_enterprise_application_platform	6.0.0	6.0.0.x
redhat / jboss_bpm_suite	6.0.0	6.0.0.x
redhat / jboss_enterprise_brms_platform	5.0.0	5.0.0.x
redhat / openshift	3.0	3.0.x
redhat / jboss_enterprise_brms_platform	6.0.0	6.0.0.x
redhat / jboss_fuse	6.0.0	6.0.0.x
redhat / subscription_asset_manager	1.3.0	1.3.0.x
redhat / jboss_fuse_service_works	6.0	6.0.x
redhat / jboss_enterprise_soa_platform	5.0.0	5.0.0.x
redhat / jboss_enterprise_application_platform	5.0.0	5.0.0.x
redhat / jboss_enterprise_web_server	3.0.0	3.0.0.x
redhat / jboss_portal	6.0.0	6.0.0.x
redhat / jboss_data_virtualization	6.0.0	6.0.0.x
redhat / jboss_data_virtualization	5.0.0	5.0.0.x
redhat / xpaas	3.0.0	3.0.0.x
redhat / data_grid	6.0.0	6.0.0.x
commons-collections / commons-collections	-	3.2.2
org.apache.commons / commons-collections4	-	4.1

Vulnerability Database

289,599

CVE-2015-7501