CVEvulnerability

CVE-2015-7501

9.8 CRITICAL Published 2017-11-09 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-11-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-502

Description

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Affected configurations

• redhat data grid 6.0.0 • redhat jboss a-mq 6.0.0 • redhat jboss bpm suite 6.0.0 • redhat jboss data virtualization 5.0.0 • redhat jboss data virtualization 6.0.0 • redhat jboss enterprise application platform 4.3.0 • redhat jboss enterprise application platform 5.0.0 • redhat jboss enterprise application platform 6.0.0 • redhat jboss enterprise brms platform 5.0.0 • redhat jboss enterprise brms platform 6.0.0 • redhat jboss enterprise soa platform 5.0.0 • redhat jboss enterprise web server 3.0.0 • redhat jboss fuse 6.0.0 • redhat jboss fuse service works 6.0 • redhat jboss operations network 3.0 • redhat jboss portal 6.0.0 • redhat openshift 3.0 • redhat subscription asset manager 1.3.0 • redhat xpaas 3.0.0

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References