CVE-2015-7501

apache-commons-collections: InvokerTransformer code execution during deserialisation

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x y 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x y 5.x; Enterprise Application Platform 6.x, 5.x y 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x y Red Hat Subscription Asset Manager 1.3 permiten que atacantes remotos ejecuten comandos arbitrarios mediante un objeto Java serializado manipulado. Esto está relacionado con la librería ACC (Apache Commons Collections).

It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2015-09-29 CVE Reserved
2015-11-20 CVE Published
2020-02-21 First Exploit
2024-08-06 CVE Updated
2024-11-21 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-284: Improper Access Control
CWE-502: Deserialization of Untrusted Data

CAPEC

References (30)

URL	Tag	Source
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
http://www.securityfocus.com/bid/78215	Third Party Advisory
http://www.securitytracker.com/id/1034097	Third Party Advisory
http://www.securitytracker.com/id/1037052	Third Party Advisory
http://www.securitytracker.com/id/1037053	Third Party Advisory
http://www.securitytracker.com/id/1037640	Third Party Advisory
https://security.netapp.com/advisory/ntap-20240216-0010
https://www.oracle.com/security-alerts/cpujul2020.html

URL	Date	SRC
https://github.com/ianxtianxt/CVE-2015-7501	2020-02-21

URL	Date	SRC

URL	Date	SRC
http://rhn.redhat.com/errata/RHSA-2015-2500.html	2024-02-16
http://rhn.redhat.com/errata/RHSA-2015-2501.html	2024-02-16
http://rhn.redhat.com/errata/RHSA-2015-2502.html	2024-02-16
http://rhn.redhat.com/errata/RHSA-2015-2514.html	2024-02-16
http://rhn.redhat.com/errata/RHSA-2015-2516.html	2024-02-16
http://rhn.redhat.com/errata/RHSA-2015-2517.html	2024-02-16
http://rhn.redhat.com/errata/RHSA-2015-2521.html	2024-02-16
http://rhn.redhat.com/errata/RHSA-2015-2522.html	2024-02-16
http://rhn.redhat.com/errata/RHSA-2015-2524.html	2024-02-16
http://rhn.redhat.com/errata/RHSA-2015-2670.html	2024-02-16
http://rhn.redhat.com/errata/RHSA-2015-2671.html	2024-02-16
http://rhn.redhat.com/errata/RHSA-2016-0040.html	2024-02-16
http://rhn.redhat.com/errata/RHSA-2016-1773.html	2024-02-16
https://access.redhat.com/security/vulnerabilities/2059393	2024-02-16
https://access.redhat.com/solutions/2045023	2020-10-19
https://bugzilla.redhat.com/show_bug.cgi?id=1279330	2020-10-19
https://rhn.redhat.com/errata/RHSA-2015-2536.html	2024-02-16
https://access.redhat.com/security/cve/CVE-2015-7501	2020-10-19

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Redhat Search vendor "Redhat"		Data Grid Search vendor "Redhat" for product "Data Grid"				6.0.0 Search vendor "Redhat" for product "Data Grid" and version "6.0.0"		-		Affected
Redhat Search vendor "Redhat"		Jboss A-mq Search vendor "Redhat" for product "Jboss A-mq"				6.0.0 Search vendor "Redhat" for product "Jboss A-mq" and version "6.0.0"		-		Affected
Redhat Search vendor "Redhat"		Jboss Bpm Suite Search vendor "Redhat" for product "Jboss Bpm Suite"				6.0.0 Search vendor "Redhat" for product "Jboss Bpm Suite" and version "6.0.0"		-		Affected
Redhat Search vendor "Redhat"		Jboss Data Virtualization Search vendor "Redhat" for product "Jboss Data Virtualization"				5.0.0 Search vendor "Redhat" for product "Jboss Data Virtualization" and version "5.0.0"		-		Affected
Redhat Search vendor "Redhat"		Jboss Data Virtualization Search vendor "Redhat" for product "Jboss Data Virtualization"				6.0.0 Search vendor "Redhat" for product "Jboss Data Virtualization" and version "6.0.0"		-		Affected
Redhat Search vendor "Redhat"		Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"				4.3.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "4.3.0"		-		Affected
Redhat Search vendor "Redhat"		Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"				5.0.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "5.0.0"		-		Affected
Redhat Search vendor "Redhat"		Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"				6.0.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.0.0"		-		Affected
Redhat Search vendor "Redhat"		Jboss Enterprise Brms Platform Search vendor "Redhat" for product "Jboss Enterprise Brms Platform"				5.0.0 Search vendor "Redhat" for product "Jboss Enterprise Brms Platform" and version "5.0.0"		-		Affected
Redhat Search vendor "Redhat"		Jboss Enterprise Brms Platform Search vendor "Redhat" for product "Jboss Enterprise Brms Platform"				6.0.0 Search vendor "Redhat" for product "Jboss Enterprise Brms Platform" and version "6.0.0"		-		Affected
Redhat Search vendor "Redhat"		Jboss Enterprise Soa Platform Search vendor "Redhat" for product "Jboss Enterprise Soa Platform"				5.0.0 Search vendor "Redhat" for product "Jboss Enterprise Soa Platform" and version "5.0.0"		-		Affected
Redhat Search vendor "Redhat"		Jboss Enterprise Web Server Search vendor "Redhat" for product "Jboss Enterprise Web Server"				3.0.0 Search vendor "Redhat" for product "Jboss Enterprise Web Server" and version "3.0.0"		-		Affected
Redhat Search vendor "Redhat"		Jboss Fuse Search vendor "Redhat" for product "Jboss Fuse"				6.0.0 Search vendor "Redhat" for product "Jboss Fuse" and version "6.0.0"		-		Affected
Redhat Search vendor "Redhat"		Jboss Fuse Service Works Search vendor "Redhat" for product "Jboss Fuse Service Works"				6.0 Search vendor "Redhat" for product "Jboss Fuse Service Works" and version "6.0"		-		Affected
Redhat Search vendor "Redhat"		Jboss Operations Network Search vendor "Redhat" for product "Jboss Operations Network"				3.0 Search vendor "Redhat" for product "Jboss Operations Network" and version "3.0"		-		Affected
Redhat Search vendor "Redhat"		Jboss Portal Search vendor "Redhat" for product "Jboss Portal"				6.0.0 Search vendor "Redhat" for product "Jboss Portal" and version "6.0.0"		-		Affected
Redhat Search vendor "Redhat"		Openshift Search vendor "Redhat" for product "Openshift"				3.0 Search vendor "Redhat" for product "Openshift" and version "3.0"		enterprise		Affected
Redhat Search vendor "Redhat"		Subscription Asset Manager Search vendor "Redhat" for product "Subscription Asset Manager"				1.3.0 Search vendor "Redhat" for product "Subscription Asset Manager" and version "1.3.0"		-		Affected
Redhat Search vendor "Redhat"		Xpaas Search vendor "Redhat" for product "Xpaas"				3.0.0 Search vendor "Redhat" for product "Xpaas" and version "3.0.0"		-		Affected