Description

Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue.

Remediation

References

https://helpx.adobe.com/security/products/coldfusion/apsb15-29.html

https://helpx.adobe.com/security/products/livecycleds/apsb15-30.html

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05073670

http://marc.info/?l=bugtraq&m=145996963420108&w=2

http://www.securityfocus.com/bid/77626

http://www.securitytracker.com/id/1034210

http://packetstormsecurity.com/files/134506/Apache-Flex-BlazeDS-4.7.1-SSRF.html

http://www.vmware.com/security/advisories/VMSA-2015-0008.html

http://www.securityfocus.com/archive/1/536958/100/0/threaded

Related Vulnerabilities

CVE-2022-35980 Vulnerability in maven package org.opensearch.plugin:opensearch-security

CVE-2019-10754 Vulnerability in maven package org.apereo.cas:cas-server-support-oidc

CVE-2022-29244 Vulnerability in maven package org.webjars.npm:npm

CVE-2018-3721 Vulnerability in npm package lodash

CVE-2019-1352 Vulnerability in npm package nodegit

Severity

Critical

Classification

CWE-20

Tags

Patch Vendor Advisory Third Party Advisory