CVE-2017-5878

Estado: ModificadaCrítica (9.8)—
The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data.
CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 9.8
Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 2.72%
Percentil entre todas las CVEs puntuadas: 86
Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)

Red5 — Media Server
CWE

CWE-502
Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-5878",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-06-08T16:29:00.433",
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2017/05/22/2",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2017/05/22/2",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data."
    },
    {
      "lang": "es",
      "value": "Los unmarshallers AMF en Red5 Media Server en versiones anteriores a la 1.0.8  no restringen las clases para las que realizan deserialización, lo que permite que atacantes remotos ejecuten código arbitrario mediante datos Java serializados manipulados."
    }
  ],
  "lastModified": "2026-06-17T01:21:22.410",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "93EA9637-BEEE-4BFF-AF94-98F1C600B8C9"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.2:milestone1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5714ECA1-B358-417F-8D88-C559535DBFA7"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45060D79-5F50-4C97-9913-A5EBBFE3EE01"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF06FE5B-803A-4448-B47A-89BA5E4C413E"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "76FCA077-ADAC-4356-83C6-2ECFA604FB93"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "732B294D-DD73-4325-8F0B-C4A3315F5034"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.7:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71B5B0AC-0AE8-4B0C-8773-53CFE5A65C85"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.7:milestone1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9FE1163-39C6-48F6-A7DE-9FE53FC4663D"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.7:milestone2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "352F4573-E09A-4049-9148-7A13C8EC8DC6"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.7:milestone3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7B5777BF-A550-4986-B2CA-68231DB49E52"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.7:milestone4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "027563CA-F625-41E3-829F-BE3FAD9CF3F8"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.7:milestone5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D8FBBC5B-9AF0-4476-9B73-7DD5D3A9DC11"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.7:milestone6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9EA0D336-802C-4E15-AA3D-54DF0F7910F1"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.7:milestone7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07DE3149-977A-42B5-808E-BFF1C217DC7D"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.8:milestone1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C671E0E0-393F-4A07-9639-4E45374AC1C2"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.8:milestone10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "247E2E41-9236-4155-9A3F-36D1F7D6946F"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.8:milestone11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "697905ED-3667-4645-A947-23AE3180A668"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.8:milestone12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC65784E-54E2-4ACA-BD41-F3F91EC54BAB"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.8:milestone13:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F653DCF-54C2-4909-BC73-60873DE49F51"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.8:milestone2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FDC7EAFC-508C-4A0E-855D-AC6630F4C2C5"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.8:milestone3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0FBA3E03-5781-492B-A70C-F54E2AB36FF7"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.8:milestone4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "419ED3FB-0E87-4A54-89E5-236B087FA92D"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.8:milestone5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A5B51B2-7662-4EDF-B09E-A69A508615F5"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.8:milestone6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "770AF897-CADC-4445-8FFE-534EC45FC678"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.8:milestone7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "81A8BD3A-499A-4CE6-B68E-E4740AE7224B"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.8:milestone8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7C63DA6-AF81-482C-9C7E-36B27FD7B335"
            },
            {
              "criteria": "cpe:2.3:o:red5:media_server:1.0.8:milestone9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC1682A9-7C56-4BFF-BE18-62FA25ED8AAB"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}