AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2017-3203

HIGH · CVSS 8.1 EPSS 6.39%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2018-06-11 · Last synced 2026-08-04

CyberRota Analysis

AI analysis pending.

CVE
CVE-2017-3203
Severity
HIGH
CVSS
8.1
EPSS
6.39%
Java

Original NVD Description

The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.