Unscored severity · published Jun 16, 2011
CVE-2011-2092
Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of classes during deserialization of…
–
CVSS
6.1%
EPSS
No
On KEV
Description
Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of classes during deserialization of (1) AMF and (2) AMFX data, which allows attackers to have an unspecified impact via unknown vectors, related to a "deserialization vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)6.1% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BL
Blazeds · Adobe
through 4.0.1 · source: NVD
LI
Livecycle · Adobe
through 9.0.0.2; 6.0; 7.0; 8.0.1; 8.0.1.1; 8.0.1.2; +1 more · source: NVD
LD
Livecycle Data Services · Adobe
through 3.1; 2.5; 2.5.1; 2.6; 2.6.1; 3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-2092
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-2092
Patch
http://www.adobe.com/support/security/bulletins/apsb11-15.html
www.securitytracker.com
http://www.securitytracker.com/id?1025656
www.securitytracker.com
http://www.securitytracker.com/id?1025657
More from Blazeds
6.5
CVE-2009-3960
Adobe BlazeDS Information Disclosure Vulnerability
–
CVE-2011-2093
Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly handle object graphs, which allows attackers to cause a…