What’s Vulnerable › Vulnerabilities

CVE-2015-5255

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2015-11-18 · updated 2026-06-17
• Weakness: CWE-20

Description

Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue.

Affected products

• Adobe ColdFusion: through 10.0; through 11.0
• Adobe Livecycle Data Services: 3.0, 4.5, 4.6, 4.7
• HP Xp7 Command View Advanced Edition: all versions
• HP Xp P9000 Command View Advanced Edition: all versions

References

• http://marc.info/?l=bugtraq&m=145996963420108&w=2
• http://packetstormsecurity.com/files/134506/Apache-Flex-BlazeDS-4.7.1-SSRF.html
• http://www.securityfocus.com/archive/1/536958/100/0/threaded
• http://www.securityfocus.com/bid/77626
• http://www.securitytracker.com/id/1034210
• http://www.vmware.com/security/advisories/VMSA-2015-0008.html
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05073670
• https://helpx.adobe.com/security/products/coldfusion/apsb15-29.html
• https://helpx.adobe.com/security/products/livecycleds/apsb15-30.html
• http://marc.info/?l=bugtraq&m=145996963420108&w=2
• http://packetstormsecurity.com/files/134506/Apache-Flex-BlazeDS-4.7.1-SSRF.html
• http://www.securityfocus.com/archive/1/536958/100/0/threaded

Get alerted when CVE-2015-5255 or the next vulnerability affects your stack