CVE-2017-3199CWE-502

GraniteDS, version 3.1.1.GA, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization

published June 11, 2018

CVSS
—
EPSS
6%
Percentile
93.3
In the wild
Unconfirmed
What it is

The Java implementation of GraniteDS, version 3.1.1.GA, AMF3 deserializers derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06044 · 93.3th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2018-06-11T17:00Z
EPSS history
Timeline
  • 11 JUN 17:00Z
    GraniteDS, version 3.1.1.GA, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization
    cvelistv5