CVE-2017-3208

9.8 criticalEPSS 3.9%

The Java implementation of AMF3 deserializers used by WebORB for Java by Midnight Coders, version 5.1.1.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly it could potentially expose sensitive data on the server, denial of service, or server side request forgery.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.9% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2018-06-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

themidnightcoders:weborb_for_java

References

http://www.securityfocus.com/bid/97384
http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution
https://codewhitesec.blogspot.com/2017/04/amf.html
https://www.kb.cert.org/vuls/id/307983
http://www.securityfocus.com/bid/97384

Check your stack JSON