CVE-2015-5255

medium

Description

Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue.

References

Advisories
More

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05073670

http://marc.info/?l=bugtraq&m=145996963420108&w=2

https://helpx.adobe.com/security/products/livecycleds/apsb15-30.html

https://helpx.adobe.com/security/products/coldfusion/apsb15-29.html

http://www.vmware.com/security/advisories/VMSA-2015-0008.html

http://www.securitytracker.com/id/1034210

http://www.securityfocus.com/bid/77626

http://www.securityfocus.com/archive/1/536958/100/0/threaded

http://packetstormsecurity.com/files/134506/Apache-Flex-BlazeDS-4.7.1-SSRF.html

Details

Source: Mitre, NVD

Published: 2015-11-18

Updated: 2025-04-12

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 4.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Severity: Medium

EPSS

EPSS: 0.01414