CVE-2015-7501

CRITICAL EXPLOITED

Red Hat - RCE

Title source: llm

Description

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Exploits (3)

nomisec WORKING POC 21 stars
by ianxtianxt · poc
https://github.com/ianxtianxt/CVE-2015-7501
vulncheck_xdb WRITEUP
remote
https://github.com/jas502n/Jboss_JMXInvokerServlet_Deserialization_RCE

References (28)

... and 8 more

Scores

CVSS v3 9.8
EPSS 0.7146
EPSS Percentile 98.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2016-01-28
ENISA EUVD EUVD-2022-3799
CWE
CWE-502
Status published
Products (24)
commons-collections/commons-collections 0 - 3.2.2Maven
net.sourceforge.collections/collections-generic Maven
org.apache.commons/commons-collections4 0 - 4.1Maven
org.apache.servicemix.bundles/org.apache.servicemix.bundles.collections-generic 4.01Maven
org.apache.servicemix.bundles/org.apache.servicemix.bundles.commons-collections 3.2.1Maven
redhat/data_grid 6.0.0
redhat/jboss_a-mq 6.0.0
redhat/jboss_bpm_suite 6.0.0
redhat/jboss_data_virtualization 5.0.0
redhat/jboss_data_virtualization 6.0.0
... and 14 more
Published Nov 09, 2017
Tracked Since Feb 18, 2026