CVE-2017-3203: Pivotal/Spring Spring-flex's Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization
Published Jun 11, 2018
·Updated
The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.
Affected Software
1 affected component
Pivotal Spring-flex
Event History
Jun 11, 2018
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2017-3203.
2
What is the severity of CVE-2017-3203?
The severity of CVE-2017-3203 is high with a score of 8.1.
3
Which software is affected by CVE-2017-3203?
Pivotal Spring-flex is affected by CVE-2017-3203.
4
What is the recommended fix for CVE-2017-3203?
Apply the necessary patches provided by the software vendor.
5
Where can I find more information about CVE-2017-3203?
You can find more information about CVE-2017-3203 at the following references: [1] [2] [3].