Unscored severity · published Jun 16, 2011
CVE-2011-2093
Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly handle object graphs, which allows attackers to cause a…
–
CVSS
3.8%
EPSS
No
On KEV
Description
Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly handle object graphs, which allows attackers to cause a denial of service via unspecified vectors, related to a "complex object graph vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)3.8% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BL
Blazeds · Adobe
through 4.0.1 · source: NVD
LI
Livecycle · Adobe
through 9.0.0.2; 6.0; 7.0; 8.0.1; 8.0.1.1; 8.0.1.2; +1 more · source: NVD
LD
Livecycle Data Services · Adobe
through 3.1; 2.5; 2.5.1; 2.6; 2.6.1; 3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-2093
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-2093
osvdb.org
http://osvdb.org/73009
Patch
http://www.adobe.com/support/security/bulletins/apsb11-15.html
www.securityfocus.com
http://www.securityfocus.com/bid/48267
www.securitytracker.com
http://www.securitytracker.com/id?1025656
www.securitytracker.com
http://www.securitytracker.com/id?1025657
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/68026
More from Blazeds
6.5
CVE-2009-3960
Adobe BlazeDS Information Disclosure Vulnerability
–
CVE-2011-2092
Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of classes during deserialization of…