Read the docs

GraniteDS

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

GraniteDS records in CISA KEV

No GraniteDS vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Graniteds 2 records MEDIUM Granite Data Services 1 record LOW

Records

2 records in Graniteds · all components

TI-2017-02405 CVE-2017-3200 · GHSA-vx9j-rvmj-jc32

Deserialization of untrusted data in GraniteDS Framework

Priority MEDIUM 44

The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.06044 Published 2018-06-11 No fix listed CWE-913
TI-2017-02404 CVE-2017-3199 · GHSA-8m35-r25c-qr56

GraniteDS, version 3.1.1.GA, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization

Priority MEDIUM 44

The Java implementation of GraniteDS, version 3.1.1.GA, AMF3 deserializers derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.06044 Published 2018-06-11 No fix listed CWE-502
Open these records in search →