CVE-2017-3207

Опубликовано: 11 июн. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

The Java implementations of AMF3 deserializers in WebORB for Java by Midnight Coders, version 5.1.1.0, derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.

Ссылки

http://www.securityfocus.com/bid/97384
Third Party Advisory
VDB Entry
http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution
Third Party Advisory
https://codewhitesec.blogspot.com/2017/04/amf.html
Exploit
Third Party Advisory
https://www.kb.cert.org/vuls/id/307983
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/97384
Third Party Advisory
VDB Entry
http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution
Third Party Advisory
https://codewhitesec.blogspot.com/2017/04/amf.html
Exploit
Third Party Advisory
https://www.kb.cert.org/vuls/id/307983
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:themidnightcoders:weborb_for_java:5.1.1.0:*:*:*:*:*:*:*

EPSS

Процентиль: 91%

0.07161

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-502

Связанные уязвимости

GHSA-9258-4rxh-qw5j