Unscored severity · published Aug 25, 2015
CVE-2015-3269
Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and…
–
CVSS
9.8%
EPSS
No
On KEV
Description
Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before 4.7.0.354169 and other products, allows remote attackers to read arbitrary files via an AMF message containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)9.8% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BS
Business Service Management · HP
through 9.26 · source: NVD
LD
Livecycle Data Services · Adobe
3.0; 4.5; 4.6; 4.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-3269
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-3269
Third Party Advisory
http://marc.info/?l=bugtraq&m=145706712500978&w=2
www.securityfocus.com
http://www.securityfocus.com/archive/1/536266/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/76394
www.securitytracker.com
http://www.securitytracker.com/id/1033337
www.vmware.com
http://www.vmware.com/security/advisories/VMSA-2015-0008.html
Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05026202
More from Livecycle Data Services
6.5
CVE-2009-3960
Adobe BlazeDS Information Disclosure Vulnerability
–
CVE-2015-5255
Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before…
–
CVE-2011-2093
Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly handle object graphs, which allows attackers to cause a…
–
CVE-2011-2092
Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of classes during deserialization of…