{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.5.2.RELEASE"}],"component":"org.springframework.flex:spring-flex","cve_ids":["CVE-2017-3203"],"ecosystem":"Maven","epss":0.06229,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-8v4h-j42h-wfhc","id":"tcs_01M5N8NEACX2Z6XBXXXKNXTRW6","modified_at":"2023-11-08T03:59:21.022673Z","published_at":"2022-05-13T01:36:43Z","references":["https://osv.dev/vulnerability/GHSA-8v4h-j42h-wfhc","https://nvd.nist.gov/vuln/detail/CVE-2017-3203","https://codewhitesec.blogspot.com/2017/04/amf.html","https://www.kb.cert.org/vuls/id/307983","http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-8v4h-j42h-wfhc","url":"https://osv.dev/vulnerability/GHSA-8v4h-j42h-wfhc"}],"summary":"Deserialization of Untrusted Data in Spring-flex"}