Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before 4.7.0.354169 and other products, allows remote attackers to read arbitrary files via an AMF message containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

The remote HP Operations Manager i host is affected by an XML external entity (XXE) vulnerability in the bundled version of Apache Flex BlazeDS due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. A remote attacker can exploit this, via a specially crafted XML file, to read and disclose arbitrary files.

The VMware vCenter Server installed on the remote host is affected by the following vulnerabilities :

  - An XML external entity (XXE) injection flaw exists in     Flex BlazeDS in the file flex-messaging-core.jar due to     an incorrectly configured XML parser accepting XML     external entities from untrusted sources. A remote     attacker can exploit this, via a specially crafted AMF     message containing an XML external entity declaration in     conjunction with an entity reference, to read arbitrary     files and thus gain access to potentially sensitive     information. (CVE-2015-3269)

  - A server-side request forgery (SSRF) vulnerability exists     in Flex BlazeDS. A remote attacker can exploit this,     via a crafted XML document, to direct HTTP traffic to     intranet servers, thus bypassing access restrictions and     allowing further host-based attacks to be conducted.
    (CVE-2015-5255)

The version of Adobe ColdFusion running on the remote Windows host is affected by an XML external entity injection (XXE) vulnerability in flex-messaging-core.jar due to an incorrect configuration of the XML parser used in the bundled version of BlazeDS. A remote attacker can exploit this, via a specially crafted AMF request, to read arbitrary files on the system.

The VMware Horizon View installed on the remote Windows host is version 5.x prior to 5.3.4 or version 6.x prior to 6.1. It is, therefore, affected by the following vulnerabilities :

  - A man-in-the-middle (MitM) information disclosure     vulnerability, known as POODLE, exists due to the way     SSL 3.0 handles padding bytes when decrypting messages     encrypted using block ciphers in cipher block chaining     (CBC) mode. A MitM attacker can decrypt a selected byte     of a cipher text in as few as 256 tries if they are able     to force a victim application to repeatedly send the     same data over newly created SSL 3.0 connections.
    (CVE-2014-3566)

  - An XML external entity (XXE) injection vulnerability     exists in the included Flex BlazeDS component due to an     incorrect configuration of the XML parser that allows     external XML entities to be accepted from untrusted     sources. An unauthenticated, remote attacker can exploit     this vulnerability, via a via a crafted AMF message, to     gain access to sensitive information. (CVE-2015-3269)

  - A flaw exists in the bundled Adobe ColdFusion and     LiveCycle Data Services components related to request     handling between a user and the server. A remote     attacker can exploit this, via a specially crafted     request, to bypass access restrictions (e.g. host or     network ACLs), conduct port scanning of internal     networks, enumerate internal hosts, or possibly invoke     additional protocols (e.g. Gopher, TFTP).
    (CVE-2015-5255)

Additionally, unspecified vulnerabilities also exist in the following bundled Java components :

  - 2D (CVE-2014-6585, CVE-2014-6591)

  - Deployment (CVE-2015-0403, CVE-2015-0406)

  - Hotspot (CVE-2014-6601, CVE-2015-0383, CVE-2015-0395,     CVE-2015-0437)

  - Installation (CVE-2015-0421)

  - JAX-WS (CVE-2015-0412)

  - JSSE (CVE-2014-6593)

  - Libraries (CVE-2014-6549, CVE-2014-6587, CVE-2015-0400)

  - RMI (CVE-2015-0408)

  - Security (CVE-2015-0410)

  - Serviceability (CVE-2015-0413)

  - Swing (CVE-2015-0407)

ID	Name	Product	Family	Type	Severity
89780	HP Operations Manager i Apache Flex BlazeDS External Entity Injection Vulnerability	Nessus	CGI abuses	Local	medium
87592	VMware vCenter Multiple Vulnerabilities (VMSA-2015-0008)	Nessus	Misc.	Remote	medium
85745	Adobe ColdFusion BlazeDS XXE (APSB15-21) (credentialed check)	Nessus	Windows	Local	medium
82741	VMware Horizon View Multiple Vulnerabilities (VMSA-2015-0003) (VMSA-2015-0008) (POODLE)	Nessus	Windows	Local	critical

Detections

Analytics

CVE-2015-3269

medium

Tenable Plugins

medium

medium

medium

critical