Home > Vulnerability Database > CVE-2015-5255

Mend Vulnerability Database

CVE-2015-5255

Good to know:

Date: November 18, 2015

Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue.

Language: Java

Severity Score

4.3

Related Resources (5)

Url: http://www.securitytracker.com/id/1034210

Url: http://www.vmware.com/security/advisories/VMSA-2015-0008.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2015-5255

Url: https://helpx.adobe.com/security/products/coldfusion/apsb15-29.html

Url: https://www.mend.io/vulnerability-database/CVE-2015-5255

Severity Score

4.3

Weakness Type (CWE)

Input Validation

CWE-20

Top Fix

Upgrade Version

Upgrade to version org.apache.flex.blazeds:flex-messaging-core:4.7.2

Learn More

CVSS v2

Base Score:	4.3
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	PARTIAL
Availability (A):	NONE
Additional information:

Mend Vulnerability Database

We found results for “”

CVE-2015-5255

Good to know:

Date: November 18, 2015

Language: Java

Severity Score

Related Resources (5)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v2

Do you need more information?