Critical severity · published Jun 11, 2018
CVE-2017-3208
The Java implementation of AMF3 deserializers used by WebORB for Java by Midnight Coders, version 5.1.1.0, allows external entity references (XXEs) from XML documents embedded…
9.8
CVSS
3.9%
EPSS
No
On KEV
Description
The Java implementation of AMF3 deserializers used by WebORB for Java by Midnight Coders, version 5.1.1.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly it could potentially expose sensitive data on the server, denial of service, or server side request forgery.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
Weborb For Java · Themidnightcoders
5.1.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-3208
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-3208
Third Party Advisory
http://www.securityfocus.com/bid/97384
Third Party Advisory
http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution
Exploit
https://codewhitesec.blogspot.com/2017/04/amf.html
Third Party Advisory
https://www.kb.cert.org/vuls/id/307983
More from Weborb For Java
9.8
CVE-2017-3207
The Java implementations of AMF3 deserializers in WebORB for Java by Midnight Coders, version 5.1.1.0, derive class instances from java.io.Externalizable rather than the AMF3…