Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
zdiPedro Ribeiro (@pedrib1337 | [email protected]) from Agile Information SecurityZDI-22-506
HistoryMar 11, 2022 - 12:00 a.m.

Cisco Nexus Dashboard Fabric Controller AMF Deserialization of Untrusted Data Remote Code Execution Vulnerability

2022-03-1100:00:00
Pedro Ribeiro (@pedrib1337 | [email protected]) from Agile Information Security
www.zerodayinitiative.com
25

0.098 Low

EPSS

Percentile

94.9%

JSON

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Nexus Dashboard Fabric Controller. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the AMF protocol. Crafted data in an AMF protocol message can trigger the deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the fmserver user.

Related

openvas 1
checkpoint_advisories 1
osv 1
hackerone 1
avleonov 1
seebug 2
zdi 1
nessus 2
prion 1
nvd 1
veracode 1
cve 1
github 1
cvelist 1
vmware 1
packetstorm 1
threatpost 1
zdt 1
myhack58 1
cert 1
impervablog 1
openvas
openvas
VMware vCenter Server Remote Code Execution Vulnerability (VMSA-2017-0007)
2017-04-18 00:00:00
checkpoint_advisories
checkpoint_advisories
Apache Flex AMF BlazeDS Java Object Deserialization Remote Code Execution (CVE-2017-5641)
2019-03-17 00:00:00
osv
osv
Apache Flex BlazeDS unsafe deserialization
2022-05-13 01:02:10
hackerone
hackerone
U.S. Dept Of Defense: [HTAF4-213] [Pre-submission] Unsafe AMF deserialization (CVE-2017-5641) in Apache Flex BlazeDS at the https://www.███████/daip/messagebroker/amf
2019-11-04 04:12:19
avleonov
avleonov
Vulnerability subscriptions in terms of business
2017-04-26 18:25:25
seebug
seebug
Vigor ACS Unsafe Flex AMF Java Object Deserialization(CVE-2017-5641)
2018-04-25 00:00:00
AMF3 Java implementations Improper Control of Dynamically-Managed Code Resources
2017-04-06 00:00:00
zdi
zdi
Cisco Nexus Dashboard Fabric Controller Improper Privilege Management Privilege Escalation Vulnerability
2022-03-11 00:00:00
nessus
nessus
VMware vCenter Server Appliance BlazeDS AMF3 RCE (VMSA-2017-0007)
2017-04-19 00:00:00
VMware vCenter Server 6.0.x < 6.0u3b / 6.5.x < 6.5c BlazeDS AMF3 RCE (VMSA-2017-0007)
2017-04-19 00:00:00
prion
prion
Deserialization of untrusted data
2017-12-28 15:29:00
nvd
nvd
CVE-2017-5641
2017-12-28 15:29:00
veracode
veracode
Remote Code Execution (RCE)
2017-04-06 08:05:24
cve
cve
CVE-2017-5641
2017-12-28 15:29:00
github
github
Apache Flex BlazeDS unsafe deserialization
2022-05-13 01:02:10
cvelist
cvelist
CVE-2017-5641
2017-03-27 00:00:00
vmware
vmware
VMware vCenter Server updates resolve a remote code execution vulnerability via BlazeDS
2017-04-13 00:00:00
packetstorm
packetstorm
Cisco ISE 2.4.0 XSS / Remote Code Execution
2019-02-05 00:00:00
threatpost
threatpost
VMWare Fixes Critical RCE in vCenter Server
2017-04-17 12:05:26
zdt
zdt
Cisco ISE 2.4.0 XSS / Remote Code Execution Exploit
2019-02-06 00:00:00
myhack58
myhack58
Java AMF3 exposure remote code execution vulnerability-vulnerability warning-the black bar safety net
2017-04-07 00:00:00
cert
cert
Action Message Format (AMF3) Java implementations are vulnerable to insecure deserialization and XML external entities references
2017-04-04 00:00:00
impervablog
impervablog
Deserialization Attacks Surge Motivated by Illegal Crypto-mining
2018-01-24 17:45:08

0.098 Low

EPSS

Percentile

94.9%

JSON
Related for ZDI-22-506
openvas1checkpoint_advisories1osv1hackerone1avleonov1seebug2zdi1nessus2prion1nvd1veracode1cve1github1cvelist1vmware1packetstorm1threatpost1zdt1myhack581cert1impervablog1