Description

Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of classes during deserialization of (1) AMF and (2) AMFX data, which allows attackers to have an unspecified impact via unknown vectors, related to a "deserialization vulnerability."

Remediation

References

http://www.adobe.com/support/security/bulletins/apsb11-15.html

http://www.securitytracker.com/id?1025656

http://www.securitytracker.com/id?1025657

Related Vulnerabilities

CVE-2023-36478 Vulnerability in maven package org.eclipse.jetty.http3:http3-qpack

CVE-2011-1772 Vulnerability in maven package com.opensymphony:xwork-core

CVE-2020-11022 Vulnerability in npm package jquery

CVE-2018-18893 Vulnerability in maven package com.hubspot.jinjava:jinjava

CVE-2020-28494 Vulnerability in npm package total.js

Severity

Critical

Classification

CWE-20

Tags

Patch Vendor Advisory