CVE-2015-7501

CRITICAL 9.8Exploited per ENISA since 2025-07-14

At a glance

Source: NVD
EPSS: EPSS 85.56 % · percentile 100 (2026-10-29)
State: PUBLISHED
Published: 2017-11-09 00:00 UTC
Updated: 2024-08-06 07:51 UTC
Assigner: redhat
NVD status: Modified

Search on…

Description

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Weaknesses (CWE)

CWE-502 — Deserialization of Untrusted Data

References

Scores

Version	Score	Vector	Scored by
CVSS 3.0	CRITICAL 9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	HIGH 10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C	NVD · nvd@nist.gov (Primary)

Advisories

GHSA-fjq5-5j5f-mvxh — Deserialization of Untrusted Data in Apache commons collections

European references

ENISA EUVD · EUVD-2022-3799
GCVE · GCVE-0-2015-7501

CERT-FR advisories

CERTFR-2026-AVI-1291 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2023-AVI-0240 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2018-AVI-350 — Multiples vulnérabilités dans Oracle Sun Systems · cert.ssi.gouv.fr
CERTFR-2018-AVI-026 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
CERTFR-2017-AVI-120 — Multiples vulnérabilités dans Oracle Sun Systems Products Suite · cert.ssi.gouv.fr
CERTFR-2017-AVI-018 — Multiples vulnérabilités dans Oracle MySQL · cert.ssi.gouv.fr
CERTFR-2016-AVI-350 — Multiples vulnérabilités dans Oracle Linux and Virtualization · cert.ssi.gouv.fr
CERTFR-2016-AVI-348 — Multiples vulnérabilités dans Oracle Database Server · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:redhat:data_grid:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_a-mq:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_bpm_suite:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_data_virtualization:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_data_virtualization:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_fuse_service_works:6.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_operations_network:3.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_portal:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift:3.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:redhat:subscription_asset_manager:1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:xpaas:3.0.0:*:*:*:*:*:*:*

Affected products

Product	Versions
	affected n/a

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

💣 CVE-2015-7501