CVE-2017-3203
High
Description
The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.
SeverityHigh
CVSS8.1
Exploit probability—
ProductPivotal Spring-flex
PublishedJun 11, 2018
First seenJun 11, 2018
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pivotal spring-flex | No range specified | — |
| org.springframework.flex:spring-flexMaven | v ≤ 1.5.2.RELEASE | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.