The Java implementations of AMF3 deserializers in WebORB for Java by Midnight Coders, version 5.1.1.0, derive class instances from java.io.Externalizable rather than the AMF3 specification’s recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.
[
{
"product": "WebORB for Java",
"vendor": "Midnight Coders",
"versions": [
{
"status": "affected",
"version": "5.1.1.0"
}
]
}
]