CVE-2017-3208: The Java implementation of AMF3 deserializers used by WebORB for Java by Midnight Coders, version 5.1.1.0,...

Security readout for executives and security teams

CVE-2017-3208 is an XML external entity issue in Java AMF3 deserialization used by WebORB for Java 5.1.1.0. A vulnerable server that processes crafted AMF3 messages could expose sensitive server data, be forced into denial of service, or make unintended server-side requests. Exposure is most likely where WebORB for Java 5.1.1.0 handles untrusted AMF3 traffic. The provided data does not include CPEs, broader version ranges, deployment prevalence, or a vendor patch statement. Prioritize review if WebORB for Java is present on exposed services or handles partner/customer traffic. Business risk is highest where the server can access sensitive files, internal metadata services, or protected internal networks. Mitigation focus: Inventory Java applications using WebORB for Java 5.1.1.0.; Check Midnight Coders or application vendor guidance for fixed versions or configuration changes.; Restrict AMF endpoints to trusted clients where business use allows..

Prepared

Jun 7, 2026, 06:44 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.