CVE-2017-3203

Description

The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specifications recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.

Risk Information

Base Score

8.1

MODERATE

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

13.418

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2017-3203 are affected in Spring - spring-flex 1.5.2	Windows
Vulnerabilities CVE-2017-3203 are affected in Spring - spring-flex for Linux 1.5.2	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234