CVE-2017-3199
High
Description
The Java implementation of GraniteDS, version 3.1.1.GA, AMF3 deserializers derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.
SeverityHigh
CVSS8.1
Exploit probability—
ProductGraniteds
PublishedJun 11, 2018
First seenJun 11, 2018
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| graniteds graniteds | 3.1.1 | — |
| org.graniteds:granite-coreMaven | v ≤ 3.1.1.GA | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.