CVE-2017-3199

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The Java implementation of GraniteDS, version 3.1.1.GA, AMF3 deserializers derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
GraniteDS	Framework	3.1.1.GA

References

http://www.securityfocus.com/bid/97382Third Party Advisory, VDB Entry
http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-executionThird Party Advisory
https://codewhitesec.blogspot.com/2017/04/amf.htmlExploit, Third Party Advisory
https://www.kb.cert.org/vuls/id/307983Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/97382Third Party Advisory, VDB Entry
http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-executionThird Party Advisory
https://codewhitesec.blogspot.com/2017/04/amf.htmlExploit, Third Party Advisory
https://www.kb.cert.org/vuls/id/307983Third Party Advisory, US Government Resource

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-32008.1The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary classes via their pub CVE-2017-32018.1The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class instances from java.io.CVE-2017-32029.8The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary CVE-2017-32038.1The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than CVE-2017-32048.1The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in CVE-2017-32069.8The Java implementation of AMF3 deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (X CVE-2017-32079.8The Java implementations of AMF3 deserializers in WebORB for Java by Midnight Coders, version 5.1.1.0, derive class instances from java.io.E CVE-2017-32089.8The Java implementation of AMF3 deserializers used by WebORB for Java by Midnight Coders, version 5.1.1.0, allows external entity references CVE-2017-32098.1The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymo CVE-2017-32107.8Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary CVE-2017-32115.3Yopify, an e-commerce notification plugin, up to April 06, 2017, leaks the first name, last initial, city, and recent purchase data of custo CVE-2017-32125.9The Space Coast Credit Union Mobile app 2.2 for iOS and 2.1.0.1104 for Android does not verify X.509 certificates from SSL servers, which al