Vulnerability Intelligence Report
CVE-2017-5878
The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
EPSS Probability:2.72%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| red5 | media_server | 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
2.717%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2017-02-03T00:00:00 |
| Published | 2017-06-08T16:00:00 |
| Patch Date | 2017-05-22 |
| Last Updated | 2024-08-05T15:11:49 |
Community Chatter & Buzz