CVE-2015-5255 Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x bef...
MediumCVSS 4.3
EPSS 4.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| HP Inc xp p9000 command view advanced edition | All versions | No fix listed |
| HP Inc xp7 command view advanced edition | All versions | No fix listed |
| Adobe coldfusion | <= 10.0 | No fix listed |
| Adobe coldfusion | <= 11.0 | No fix listed |
| Adobe livecycle data services | = 3.0 | No fix listed |
| Adobe livecycle data services | = 4.5 | No fix listed |
| Adobe livecycle data services | = 4.6 | No fix listed |
| Adobe livecycle data services | = 4.7 | No fix listed |
References
- HPSBST03568 third-party-advisory vendor-advisory
- packetstormsecurity.com
- 20151123 CVE-2015-5255: SSRF vulnerability in Apache Flex BlazeDS 4.7.1 mailing-list
- 77626 vdb-entry
- 1034210 vdb-entry
- www.vmware.com
- h20566.www2.hpe.com third-party-advisory
- helpx.adobe.com patch vendor-advisory
- helpx.adobe.com patch vendor-advisory