VULNERABILITY INTELLIGENCE

CVE-2017-5878

CVSS score9.8 CRITICAL
EPSS probability2.72%
CISA KEVNot currently listed
Published2017-06-08
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data.

Weakness classification

  • CWE-502: Deserialization of Untrusted Data

Primary references