Exadel's vulnerability profile centers on its Flamingo framework and related AMF serialization components, which handle marshaling and deserialization of untrusted data in web application contexts. The recurring weakness classes—untrusted deserialization, improper control of dynamically-managed code resources, and improper XML external entity handling—reflect the risks inherent to data-binding and templating mechanisms that process external input. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Exadel over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2017-3202CRITICAL The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their public parameter-less | Jun 11, 2018 | 9.8 | 37 | NO | NO |
CVE-2017-3206CRITICAL The Java implementation of AMF3 deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML documents embedded within | Jun 11, 2018 | 9.8 | 31 | NO | NO |
CVE-2017-3201HIGH The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class instances from java.io.Externalizable rather than the AMF3 spec | Jun 11, 2018 | 8.1 | 22 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Exadel.
Media articles that mention a CVE ID that affects a product developed by Exadel — matched by CVE ID, not by vendor name.