CVE-2017-3202
Summary
| CVE | CVE-2017-3202 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-06-11 17:29:00 UTC |
| Updated | 2019-10-09 23:27:00 UTC |
| Description | The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this vulnerability depends on the availability of classes in the class path that make use of deserialization. A remote attacker with the ability to spoof or control information may be able to send serialized Java objects with pre-set properties that result in arbitrary code execution when deserialized. |
Risk And Classification
Problem Types: CWE-502
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| code white | Blog: AMF – Another Malicious Format | MISC | codewhitesec.blogspot.com | Exploit, Third Party Advisory |
| VU#307983 - Action Message Format (AMF3) Java implementations are vulnerable to insecure deserialization and XML external entities references | CERT-VN | www.kb.cert.org | Third Party Advisory, US Government Resource |
| Flaws in Java AMF Libraries Allow Remote Code Execution | SecurityWeek.Com | MISC | www.securityweek.com | Third Party Advisory |
| Exadel Flamingo Multiple Remote Code Execution and XML External Entity Injection Vulnerabilities | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 996924 Java (Maven) Security Update for com.exadel.flamingo.flex:amf-serializer (GHSA-j88v-q3vw-p9vr)