CVE-2015-5255

Sažetak

Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue.

Reference

http://marc.info/?l=bugtraq&m=145996963420108&w=2
http://packetstormsecurity.com/files/134506/Apache-Flex-BlazeDS-4.7.1-SSRF.html
http://www.securityfocus.com/archive/1/536958/100/0/threaded
http://www.securityfocus.com/bid/77626
http://www.securitytracker.com/id/1034210
http://www.vmware.com/security/advisories/VMSA-2015-0008.html
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05073670
https://helpx.adobe.com/security/products/coldfusion/apsb15-29.html
https://helpx.adobe.com/security/products/livecycleds/apsb15-30.html

CVSS

Base:	4.3
Impact:	2.9
Exploitability:	8.6

Pristup

Vektor	Složenost	Autentikacija
NETWORK	MEDIUM	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
NONE	PARTIAL	NONE

CVSS vektor

AV:N/AC:M/Au:N/C:N/I:P/A:N

Zadnje važnije ažuriranje

04-09-2020 - 14:05

Objavljeno

18-11-2015 - 21:59