Apache Synapse vulnerabilities

1 known vulnerability affecting apache/synapse.

Total CVEs
1
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1

Vulnerabilities

Page 1 of 1
CVE-2017-15708CRITICALCVSS 9.8v1.0v1.1+6 more2017-12-11
CVE-2017-15708 [CRITICAL] CWE-74 CVE-2017-15708: In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.
nvd