Deserialization of untrusted data in Midnight Coders WebORB for Java
Priority MEDIUM 53CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-502.
Summary
The Java implementations of AMF3 deserializers in WebORB for Java by Midnight Coders, version 5.1.1.0, derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.
Why it matters now
EPSS 0.08075 94th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Midnight Coders | WebORB for Java | 5.1.1.0 | — | No fix listed | CNA |
- WebORB for Java VendorMidnight Coders Affected 5.1.1.0 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:themidnightcoders:weborb_for_java:5.1.1.0:*:*:*:*:*:*:* | 5.1.1.0 | Vulnerable | Themidnightcoders |
- cpe:2.3:a:themidnightcoders:weborb_for_java:5.1.1.0:*:*:*:*:*:*:* Versions 5.1.1.0 Vulnerable ·Themidnightcoders
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-3207
- 2026-10-03 Alias added: GHSA-9258-4rxh-qw5j
References
More Themidnightcoders Weborb For Java vulnerabilities
- TI-2017-02412 The Java implementation of AMF3 deserializers used by WebORB for Java by Midnight Coders… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2017-3207 · CVE Program
- CVE-2017-3207 · NVD
- FIRST EPSS
- GHSA-9258-4rxh-qw5j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences