CVE-2017-3199

PoC —

CVSS 3.1

8.1 high

EPSS

6%p93

Published

Jun 11, 2018 (Jun 11, 2018)

Modified

Jun 17, 2026

Description

The Java implementation of GraniteDS, version 3.1.1.GA, AMF3 deserializers derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.

Vendors: graniteds
Products: graniteds
Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (6.1%)

In the news0 stories

No ingested article mentions this CVE yet.