Unrated severityNVD Advisory· Published Nov 18, 2015· Updated May 6, 2026
CVE-2015-5255
CVE-2015-5255
Description
Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue.
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
9- helpx.adobe.com/security/products/coldfusion/apsb15-29.htmlnvdPatchVendor Advisory
- helpx.adobe.com/security/products/livecycleds/apsb15-30.htmlnvdPatchVendor Advisory
- marc.infonvdThird Party Advisory
- h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplaynvdThird Party Advisory
- packetstormsecurity.com/files/134506/Apache-Flex-BlazeDS-4.7.1-SSRF.htmlnvd
- www.securityfocus.com/archive/1/536958/100/0/threadednvd
- www.securityfocus.com/bid/77626nvd
- www.securitytracker.com/id/1034210nvd
- www.vmware.com/security/advisories/VMSA-2015-0008.htmlnvd
News mentions
0No linked articles in our index yet.