CVE-2017-3208

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Java implementation of AMF3 deserializers used by WebORB for Java by Midnight Coders, version 5.1.1.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly it could potentially expose sensitive data on the server, denial of service, or server side request forgery.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/97384Third Party Advisory, VDB Entry
http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-executionThird Party Advisory
https://codewhitesec.blogspot.com/2017/04/amf.htmlExploit, Third Party Advisory
https://www.kb.cert.org/vuls/id/307983Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/97384Third Party Advisory, VDB Entry
http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-executionThird Party Advisory
https://codewhitesec.blogspot.com/2017/04/amf.htmlExploit, Third Party Advisory
https://www.kb.cert.org/vuls/id/307983Third Party Advisory, US Government Resource

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-32098.1The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymo CVE-2017-32107.8Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary CVE-2017-32115.3Yopify, an e-commerce notification plugin, up to April 06, 2017, leaks the first name, last initial, city, and recent purchase data of custo CVE-2017-32125.9The Space Coast Credit Union Mobile app 2.2 for iOS and 2.1.0.1104 for Android does not verify X.509 certificates from SSL servers, which al CVE-2017-32135.9The Think Mutual Bank Mobile Banking app 3.1.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle a CVE-2017-32147.5The Milwaukee ONE-KEY Android mobile application stores the master token in plaintext in the apk binary.CVE-2017-32155.3The Milwaukee ONE-KEY Android mobile application uses bearer tokens with an expiration of one year. This bearer token, in combination with a CVE-2017-32169.8WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote CVE-2017-32178.1CalAmp LMU 3030 series OBD-II CDMA and GSM devices has an SMS (text message) interface that can be deployed where no password is configured CVE-2017-32188.8Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP CVE-2017-32198.8Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified us CVE-2017-32219.8Blind SQL injection in Inmarsat AmosConnect 8 login form allows remote attackers to access user credentials, including user names and passwo