CVE-2017-3202

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this vulnerability depends on the availability of classes in the class path that make use of deserialization. A remote attacker with the ability to spoof or control information may be able to send serialized Java objects with pre-set properties that result in arbitrary code execution when deserialized.

• CWE-913
• CWE-502

• http://www.securityfocus.com/bid/97380Third Party Advisory, VDB Entry
• http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-executionThird Party Advisory
• https://codewhitesec.blogspot.com/2017/04/amf.htmlExploit, Third Party Advisory
• https://www.kb.cert.org/vuls/id/307983Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/97380Third Party Advisory, VDB Entry
• http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-executionThird Party Advisory
• https://codewhitesec.blogspot.com/2017/04/amf.htmlExploit, Third Party Advisory
• https://www.kb.cert.org/vuls/id/307983Third Party Advisory, US Government Resource

Published

Jun 11, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-3196PCAUSA Rawether framework does not properly validate BPF dat…
• CVE-2017-3197GIGABYTE BRIX UEFI firmware for the GB-BSi7H-6500 (version F…
• CVE-2017-3198GIGABYTE BRIX UEFI firmware does not cryptographically valid…
• CVE-2017-3199The Java implementation of GraniteDS, version 3.1.1.GA, AMF3…8.1
• CVE-2017-3200The Java implementation of AMF3 deserializers used in Granit…8.1
• CVE-2017-3201The Java implementation of AMF3 deserializers used in Flamin…
• CVE-2017-3203The Java implementations of AMF3 deserializers in Pivotal/Sp…
• CVE-2017-3204The Go SSH library (x/crypto/ssh) by default does not verify…8.1
• CVE-2017-3206The Java implementation of AMF3 deserializers used by Flamin…
• CVE-2017-3207The Java implementations of AMF3 deserializers in WebORB for…
• CVE-2017-3208The Java implementation of AMF3 deserializers used by WebORB…
• CVE-2017-3209The DBPOWER U818A WIFI quadcopter drone provides FTP access …8.1