CVE-2015-5255

Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue.

• CWE-20

• http://marc.info/?l=bugtraq&m=145996963420108&w=2Third Party Advisory
• http://packetstormsecurity.com/files/134506/Apache-Flex-BlazeDS-4.7.1-SSRF.html
• http://www.securityfocus.com/archive/1/536958/100/0/threaded
• http://www.securityfocus.com/bid/77626
• http://www.securitytracker.com/id/1034210
• http://www.vmware.com/security/advisories/VMSA-2015-0008.html
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05073670Third Party Advisory
• https://helpx.adobe.com/security/products/coldfusion/apsb15-29.htmlPatch, Vendor Advisory
• https://helpx.adobe.com/security/products/livecycleds/apsb15-30.htmlPatch, Vendor Advisory
• http://marc.info/?l=bugtraq&m=145996963420108&w=2Third Party Advisory
• http://packetstormsecurity.com/files/134506/Apache-Flex-BlazeDS-4.7.1-SSRF.html
• http://www.securityfocus.com/archive/1/536958/100/0/threaded
• http://www.securityfocus.com/bid/77626
• http://www.securitytracker.com/id/1034210
• http://www.vmware.com/security/advisories/VMSA-2015-0008.html
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05073670Third Party Advisory
• https://helpx.adobe.com/security/products/coldfusion/apsb15-29.htmlPatch, Vendor Advisory
• https://helpx.adobe.com/security/products/livecycleds/apsb15-30.htmlPatch, Vendor Advisory

Published

Nov 18, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-5249Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2015-5250The API server in OpenShift Origin 1.0.5 allows remote attac…
• CVE-2015-5251OpenStack Image Service (Glance) before 2014.2.4 (juno) and …
• CVE-2015-5252vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x befo…7.2
• CVE-2015-5253The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x b…
• CVE-2015-5254Apache ActiveMQ 5.x before 5.13.0 does not restrict the clas…
• CVE-2015-5256Apache Cordova-Android before 4.1.0, when an application rel…
• CVE-2015-5257drivers/usb/serial/whiteheat.c in the Linux kernel before 4.…
• CVE-2015-5258Cross-site request forgery (CSRF) vulnerability in springfra…8.8
• CVE-2015-5259Integer overflow in the read_string function in libsvn_ra_sv…
• CVE-2015-5260Heap-based buffer overflow in SPICE before 0.12.6 allows gue…
• CVE-2015-5261Heap-based buffer overflow in SPICE before 0.12.6 allows gue…