CVE-2015-3269

Sažetak

Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before 4.7.0.354169 and other products, allows remote attackers to read arbitrary files via an AMF message containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Reference

https://helpx.adobe.com/security/products/livecycleds/apsb15-20.html
http://marc.info/?l=bugtraq&m=145706712500978&w=2
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05026202
http://www.securityfocus.com/bid/76394
http://www.vmware.com/security/advisories/VMSA-2015-0008.html
https://helpx.adobe.com/content/help/en/security/products/coldfusion/apsb15-21.html
http://www.securitytracker.com/id/1033337
http://www.securityfocus.com/archive/1/536266/100/0/threaded
https://www.zerodayinitiative.com/advisories/ZDI-22-508/

CVSS

Base:	5.0
Impact:	2.9
Exploitability:	10.0

Pristup

Vektor	Složenost	Autentikacija
NETWORK	LOW	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
PARTIAL	NONE	NONE

CVSS vektor

AV:N/AC:L/Au:N/C:P/I:N/A:N

Zadnje važnije ažuriranje

11-03-2022 - 17:15

Objavljeno

25-08-2015 - 01:59