AUGUST 4, 2026
Live Feed
Return to register
Case File

CVE-2017-3201

HIGH · CVSS 8.1 EPSS 5.43%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2018-06-11 · Last synced 2026-08-04

Field Assessment

AI analysis pending.

CVE
CVE-2017-3201
Severity
HIGH
CVSS
8.1
EPSS
5.43%
Java

Original Filing — NVD Description

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.