Injection Vulnerability
In Apache Synapse, no authentication is required by default for Java Remote Method Invocation (RMI), resulting in Apache Synapse allowing remote code execution attacks that can be performed by injecting specially crafted serialized objects. The presence of Apache Commons Collections (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, RMI access must be restricted to trusted users only.