CVE-2015-5255: Input Validation
Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5255?
CVE-2015-5255 has a critical severity level due to its potential for SSRF (Server-Side Request Forgery) exploitation.
How do I fix CVE-2015-5255?
To mitigate CVE-2015-5255, update Adobe ColdFusion to the latest version or apply the patches provided by Adobe.
Which versions of Adobe software are affected by CVE-2015-5255?
CVE-2015-5255 affects Adobe ColdFusion 10 (before Update 18), ColdFusion 11 (before Update 7), and various versions of Adobe LiveCycle Data Services.
Is there a workaround for CVE-2015-5255?
Disabling or restricting SSRF functionality in your affected applications can serve as a temporary workaround for CVE-2015-5255.
What are the potential risks of CVE-2015-5255 exploitation?
Exploitation of CVE-2015-5255 could allow remote attackers to send unauthorized HTTP requests, potentially leading to further attacks on the internal network.