Filtered by vendor Exadel Subscriptions
Filtered by product Flamingo Amf-serializer Subscriptions
Total 1 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2017-3201 1 Exadel 1 Flamingo Amf-serializer 2024-11-21 N/A
The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.