CVE-2017-8045

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	Spring AMQP Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7	Spring AMQP Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7

References

http://www.securityfocus.com/bid/100936Third Party Advisory, VDB Entry
https://pivotal.io/security/cve-2017-8045Vendor Advisory
http://www.securityfocus.com/bid/100936Third Party Advisory, VDB Entry
https://pivotal.io/security/cve-2017-8045Vendor Advisory

Timeline

Published: Nov 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-80469.8Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1 CVE-2017-80476.1In Cloud Foundry router routing-release all versions prior to v0.163.0 and cf-release all versions prior to v274, in some applications, it i CVE-2017-80487.8In Cloud Foundry capi-release versions 1.33.0 and later, prior to 1.42.0 and cf-release versions 268 and later, prior to 274, the original f CVE-2017-80507.5Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin passwo CVE-2017-80519.8Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipul CVE-2017-80526.1Craft CMS before 2.6.2974 allows XSS attacks.CVE-2017-80535.5PoDoFo 0.9.5 allows denial of service (infinite recursion and stack consumption) via a crafted PDF file in PoDoFo::PdfParser::ReadDocumentSt CVE-2017-80545.5The function PdfPagesTree::GetPageNodeFromArray in PdfPageTree.cpp:464 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service CVE-2017-80555.3WatchGuard Fireware allows user enumeration, e.g., in the Firebox XML-RPC login handler. A login request that contains a blank password sent CVE-2017-80565.3WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC agent. This causes th CVE-2017-80575.3In Joomla! 3.4.0 through 3.6.5 (fixed in 3.7.0), multiple files caused full path disclosures on systems with enabled error reporting.CVE-2017-80585.9Acceptance of invalid/self-signed TLS certificates in Atlassian HipChat before 3.16.2 for iOS allows a man-in-the-middle and/or physically p