CVE-2017-3200
CVSS v3
8.1
HIGH
EPSS Score
13.7 %
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this vulnerability depends on the availability of classes in the class path that make use of deserialization. A remote attacker with the ability to spoof or control information may be able to send serialized Java objects with pre-set properties that result in arbitrary code execution when deserialized.
Technical details
- Published
- 2018-06-11
Frequently asked questions
What is CVE-2017-3200?
The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this vulnerability depends on the availability of classes in the class path that make use of deserialization. A remote attacker with the ability to spoof or control information may be able to send serialized Java objects with pre-set properties that result in arbitrary code execution when deserialized.
Is CVE-2017-3200 actively exploited?
Active exploitation of CVE-2017-3200 has not been confirmed. The EPSS score is 13.7%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2017-3200?
CVE-2017-3200 has a CVSS v3 base score of 8.1 (HIGH severity).
Is CVE-2017-3200 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2017 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).