Lucene search

CVE-2017-3202

🗓️ 11 Jun 2018 17:00:29Reported by [email protected]Type

The Flamingo amf-serializer in Exadel Java implementation version 2.2.0 allows arbitrary class instantiation and Java Beans setter method calls, leading to potential remote code execution

Reporter	Title	Published	Views	Family All 9
OSV	Deserialization of Untrusted Data in Flamingo amf-serializer	13 May 202201:36	–	osv
CVE	CVE-2017-3202	11 Jun 201817:29	–	cve
Veracode	Remote Code Execution (RCE)	6 Apr 201707:17	–	veracode
Prion	Deserialization of untrusted data	11 Jun 201817:29	–	prion
Github Security Blog	Deserialization of Untrusted Data in Flamingo amf-serializer	13 May 202201:36	–	github
Cvelist	CVE-2017-3202 The implementation of Action Message Format (AMF3) deserializers in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes due to improper code control	11 Jun 201817:00	–	cvelist
seebug.org	AMF3 Java implementations Improper Control of Dynamically-Managed Code Resources	6 Apr 201700:00	–	seebug
myhack58	Java AMF3 exposure remote code execution vulnerability-vulnerability warning-the black bar safety net	7 Apr 201700:00	–	myhack58
CERT	Action Message Format (AMF3) Java implementations are vulnerable to insecure deserialization and XML external entities references	4 Apr 201700:00	–	cert

Nvd

Node

exadel flamingoMatch2.2.0

Source	Link
kb	www.kb.cert.org/vuls/id/307983
securityfocus	www.securityfocus.com/bid/97380
securityweek	www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution
codewhitesec	www.codewhitesec.blogspot.com/2017/04/amf.html

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

11 Jun 2018 17:29Current

9.5High risk

Vulners AI Score9.5

CVSS27.5

CVSS39.8

EPSS0.11459