Unscored severity · published Nov 18, 2015
CVE-2015-5255
Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before…
–
CVSS
4.5%
EPSS
No
On KEV
Description
Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.5% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
ColdFusion · Adobe
through 10.0; through 11.0 · source: NVD
LD
Livecycle Data Services · Adobe
3.0; 4.5; 4.6; 4.7 · source: NVD
XP
XP P9000 Command View Advanced Edition · HP
All versions, or not specified · source: NVD
XC
Xp7 Command View Advanced Edition · HP
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5255
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5255
Third Party Advisory
http://marc.info/?l=bugtraq&m=145996963420108&w=2
packetstormsecurity.com
http://packetstormsecurity.com/files/134506/Apache-Flex-BlazeDS-4.7.1-SSRF.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/536958/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/77626
www.securitytracker.com
http://www.securitytracker.com/id/1034210
www.vmware.com
http://www.vmware.com/security/advisories/VMSA-2015-0008.html
More from ColdFusion
10.0
CVE-2026-48282
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
9.8
CVE-2023-38203
Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE
9.8
CVE-2023-29300
Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
9.8
CVE-2023-26359
Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
9.8
CVE-2018-15961
Adobe ColdFusion Unrestricted File Upload Vulnerability