8.1

CVE-2017-3201

Exploit

Flamingo amf-serializer by Exadel, version 2.2.0, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Exadel ≫ Flamingo Amf-serializer Version2.2.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.39% 0.916
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.1 2.2 5.9
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://www.kb.cert.org/vuls/id/307983
Third Party Advisory
http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution
Third Party Advisory
https://codewhitesec.blogspot.com/2017/04/amf.html
Third Party Advisory
Exploit
http://www.securityfocus.com/bid/97380
Third Party Advisory
VDB Entry