CVE-2017-3206 | BDVDB-2026-102182 Detail

ExadelFlamingo amf-serializer

Description#

The Java implementation of AMF3 deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly it could potentially expose sensitive data on the server, denial of service, or server side request forgery.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-611 Improper Restriction of XML External Entity Reference

References#

https://codewhitesec.blogspot.com/2017/04/amf.html
https://www.kb.cert.org/vuls/id/307983
http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution
http://www.securityfocus.com/bid/97380

Exploit#

No public exploit known

History#

Version 12018-06-11Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.