Critical severity · published Nov 9, 2017
CVE-2015-7501
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x;…
9.8
CVSS
85.6%
EPSS
No
On KEV
Description
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)85.6% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DG
Data Grid · Redhat
6.0.0 · source: NVD
JA
Jboss A-mq · Redhat
6.0.0 · source: NVD
JB
Jboss Bpm Suite · Redhat
6.0.0 · source: NVD
JD
Jboss Data Virtualization · Redhat
5.0.0; 6.0.0 · source: NVD
JE
Jboss Enterprise Application Platform · Redhat
4.3.0; 5.0.0; 6.0.0 · source: NVD
JE
Jboss Enterprise Brms Platform · Redhat
5.0.0; 6.0.0 · source: NVD
JE
Jboss Enterprise Soa Platform · Redhat
5.0.0 · source: NVD
JE
Jboss Enterprise Web Server · Redhat
3.0.0 · source: NVD
JF
Jboss Fuse · Redhat
6.0.0 · source: NVD
JF
Jboss Fuse Service Works · Redhat
6.0 · source: NVD
JO
Jboss Operations Network · Redhat
3.0 · source: NVD
JP
Jboss Portal · Redhat
6.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7501
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-7501
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-2500.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-2501.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-2502.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-2514.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-2516.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-2517.html
More from Data Grid
9.8
CVE-2021-31917
A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0)
9.6
CVE-2025-12543
Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf
9.1
CVE-2026-28369
Undertow: undertow: request smuggling via malformed http request headers
9.1
CVE-2026-28367
Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator
9.1
CVE-2026-28368
Undertow: undertow: request smuggling via inconsistent header parsing