CVE-2017-3203

Name of the Vulnerable Software and Affected Versions: Pivotal/Spring Spring-flex (affected versions not specified)

Description: The issue concerns the Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex, which derive class instances from java.io.Externalizable instead of following the AMF3 specification's recommendation of flash.utils.IExternalizable. This could allow a remote attacker, who has the ability to spoof or control an RMI server connection, to send serialized Java objects that execute arbitrary code when deserialized.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.