GraniteDS, version 3.1.1.GA, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization

Also known as GHSA-8m35-r25c-qr56

Published 8 y ago 2018-06-11 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.1

v3.1 · NVD

CISA KEV

not known exploited

EPSS

6.0%

percentile 93%

Public exploits

none known

The Java implementation of GraniteDS, version 3.1.1.GA, AMF3 deserializers derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.

Exploit prediction (EPSS)

6.04% probability of exploitation in the next 30 days, higher than 93% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	8.1	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`
GitHub	3.1	8.1	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.graniteds:granite-core`	<=3.1.1.GA	no fix listed

Affected products

GraniteDS Framework

Classification

Weakness

CWE-502 Deserialization of Untrusted Data

References

securityfocus.com /bid/97382 · vdb-entry, x_refsource_BID, x_transferred
codewhitesec.blogspot.com /2017/04/amf.html · x_refsource_MISC, x_transferred
kb.cert.org /vuls/id/307983 · third-party-advisory, x_refsource_CERT-VN, x_transferred
securityweek.com /flaws-java-amf-libraries-allow-remote-code-execution · x_refsource_MISC, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-3199 · advisory
github.com /graniteds/graniteds · package
web.archive.org /web/20210124021547/http://www.securityfocus.com/bid/97382 · web

Sources

CVE List: CVE-2017-3199
GitHub Advisory: GHSA-8m35-r25c-qr56
NVD: CVE-2017-3199

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary