Sign-up

ID

VAR-201511-0308


CVE

CVE-2015-5255


TITLE

Adobe ColdFusion and LiveCycle Data Services Used in Adobe BlazeDS In HTTP Vulnerability in sending traffic to intranet servers

Trust: 0.8

sources: JVNDB: JVNDB-2015-005981

DESCRIPTION

Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue. Multiple Adobe products are prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n a-c05073670 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05073670 Version: 1 HPSBST03568 rev.1 - HP XP7 Command View Advanced Edition Suite including Device Manager and Hitachi Automation Director (HAD), Remote Server-Side Request Forgery (SSRF) NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2016-04-06 Last Updated: 2016-04-06 Potential Security Impact: Remote Server-Side Request Forgery (SSRF) Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP XP7 Command View Advanced Edition Suite and HP XP P9000 Command View Advanced Edition Software including Device Manager and Hitachi Automation Director (HAD). The vulnerability could be remotely exploited resulting in Server-Side Request Forgery (SSRF). References: CVE-2015-5255 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP XP P9000 Command View Advanced Edition Software and HP XP7 Command View Advanced Edition Suite: HP Device Manager Software v7.0.0-00 to earlier than v8.4.0-00 Hitachi Automation Director (HAD) for Windows and Linux v8.1.1-00 to earlier than 8.4.0-00 BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2015-5255 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HPE has released the following software updates to resolve the vulnerability in HP XP7 Command View Advanced Edition Suite and HP XP P9000 Command View Advanced Edition: - HP Device Manager Software v8.4.0-00 - Hitachi Automation Director (HAD) for Windows and Linux v8.4.0-00 HISTORY Version:1 (rev.1) - 6 April 2016 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability with any HPE supported product, send Email to: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJXBUdsAAoJEGIGBBYqRO9/QR0H/1n7MvC34yG/bAynnPVOwwun d7+PjDWg6S3zm0X3TTODxNw5XvKtSPW5gsj+ugdkj0MnooGP+ETOLkJgKro6xx+c FvVQChknCB03/Ul+ZED4RXG4XxPAXfrEYisGQ8DogqT8szAEGvkq4AA/aStXYOjT F+yAEJPTMsNZkAeyzWsvJnqxQ7/7BUESJrV5akJvjs7BvArGFWn8FPDjAJuyHGoM D7UD7HLutYaR25TIaqLaVoNokgMq6wLXzLntxM5cB3X98ThYEI23M3XNmxfbhXKQ Q8rAsVpXeGMgObS/nURFMSSPNU7boGZFtSU9mZQilb59V4Xko5wsauUKjP4r8Dk= =xRCI -----END PGP SIGNATURE-----

Trust: 1.98

sources: NVD: CVE-2015-5255 // JVNDB: JVNDB-2015-005981 // BID: 77626 // PACKETSTORM: 136600

AFFECTED PRODUCTS

vendor:adobemodel:livecycle data servicesscope:eqversion:3.0

Trust: 1.9

vendor:adobemodel:livecycle data servicesscope:eqversion:4.6

Trust: 1.6

vendor:adobemodel:livecycle data servicesscope:eqversion:4.7

Trust: 1.6

vendor:adobemodel:livecycle data servicesscope:eqversion:4.5

Trust: 1.6

vendor:adobemodel:coldfusionscope:lteversion:10.0

Trust: 1.0

vendor:hpmodel:xp p9000 command view advanced editionscope:eqversion: -

Trust: 1.0

vendor:hpmodel:xp7 command view advanced editionscope:eqversion: -

Trust: 1.0

vendor:adobemodel:coldfusionscope:lteversion:11.0

Trust: 1.0

vendor:adobemodel:livecycle data servicesscope:eqversion:3.0.0.354175

Trust: 0.8

vendor:adobemodel:livecycle data servicesscope:eqversion:3.1.0.354180

Trust: 0.8

vendor:adobemodel:livecycle data servicesscope:ltversion:3.0.x (windows/macintosh/unix)

Trust: 0.8

vendor:adobemodel:coldfusionscope:eqversion:11 update 7

Trust: 0.8

vendor:adobemodel:coldfusionscope:eqversion:10 update 18

Trust: 0.8

vendor:hitachimodel:jp1/it desktop management - managerscope: - version: -

Trust: 0.8

vendor:hitachimodel:jp1/automatic operationscope: - version: -

Trust: 0.8

vendor:adobemodel:livecycle data servicesscope:ltversion:4.6.2.x (windows/macintosh/unix)

Trust: 0.8

vendor:hitachimodel:job management partner 1/it desktop managementscope:eqversion:2 - manager

Trust: 0.8

vendor:adobemodel:livecycle data servicesscope:eqversion:4.7.0.354178

Trust: 0.8

vendor:adobemodel:livecycle data servicesscope:eqversion:4.5.1.354177

Trust: 0.8

vendor:adobemodel:coldfusionscope:ltversion:11

Trust: 0.8

vendor:adobemodel:coldfusionscope:ltversion:10

Trust: 0.8

vendor:adobemodel:livecycle data servicesscope:ltversion:3.1.x (windows/macintosh/unix)

Trust: 0.8

vendor:adobemodel:livecycle data servicesscope:ltversion:4.5.x (windows/macintosh/unix)

Trust: 0.8

vendor:adobemodel:livecycle data servicesscope:eqversion:4.6.2.354178

Trust: 0.8

vendor:adobemodel:livecycle data servicesscope:ltversion:4.7.x (windows/macintosh/unix)

Trust: 0.8

vendor:hitachimodel:it operations directorscope: - version: -

Trust: 0.8

vendor:hitachimodel:compute systems managerscope:eqversion:software ( domestic version )

Trust: 0.8

vendor:hitachimodel:jp1/it desktop managementscope:eqversion:2 - manager

Trust: 0.8

vendor:hitachimodel:job management partner 1/it desktop management - managerscope: - version: -

Trust: 0.8

vendor:hitachimodel:compute systems managerscope:eqversion:software ( overseas edition )

Trust: 0.8

vendor:hitachimodel:automation directorscope: - version: -

Trust: 0.8

vendor:hitachimodel:job management partnerscope:eqversion:1/automatic operation

Trust: 0.8

vendor:hitachimodel:device managerscope:eqversion:software

Trust: 0.8

vendor:adobemodel:coldfusionscope:eqversion:10.0

Trust: 0.6

vendor:adobemodel:coldfusionscope:eqversion:11.0

Trust: 0.6

vendor:adobemodel:livecycle data servicesscope:eqversion:3.1

Trust: 0.3

sources: BID: 77626 // JVNDB: JVNDB-2015-005981 // CNNVD: CNNVD-201511-298 // NVD: CVE-2015-5255

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-5255
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-5255
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201511-298
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2015-5255
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

sources: JVNDB: JVNDB-2015-005981 // CNNVD: CNNVD-201511-298 // NVD: CVE-2015-5255

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.8

sources: JVNDB: JVNDB-2015-005981 // NVD: CVE-2015-5255

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201511-298

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201511-298

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-005981

PATCH
title:APSB15-29url:https://helpx.adobe.com/security/products/coldfusion/apsb15-29.html
Trust: 0.8
title:APSB15-30url:https://helpx.adobe.com/security/products/livecycleds/apsb15-30.html
Trust: 0.8
title:APSB15-29url:https://helpx.adobe.com/jp/security/products/coldfusion/apsb15-29.html
Trust: 0.8
title:APSB15-30url:https://helpx.adobe.com/jp/security/products/livecycleds/apsb15-30.html
Trust: 0.8
title:HS16-007url:http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS16-007/index.html
Trust: 0.8
title:HS16-009url:http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS16-009/index.html
Trust: 0.8
title:HS16-005url:http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS16-005/index.html
Trust: 0.8
title:HS16-007url:http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS16-007/index.html
Trust: 0.8
title:HS16-009url:http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS16-009/index.html
Trust: 0.8
title:HS16-005url:http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS16-005/index.html
Trust: 0.8
title:Adobe ColdFusion  and LiveCycle Data Services BlazeDS Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=58782
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2015-005981 // 
            
            
            
            CNNVD: CNNVD-201511-298

EXTERNAL IDS
db:NVDid:CVE-2015-5255
Trust: 2.8
db:BIDid:77626
Trust: 1.9
db:SECTRACKid:1034210
Trust: 1.6
db:PACKETSTORMid:134506
Trust: 1.6
db:JVNDBid:JVNDB-2015-005981
Trust: 0.8
db:CNNVDid:CNNVD-201511-298
Trust: 0.6
db:HITACHIid:HS16-005
Trust: 0.3
db:PACKETSTORMid:136600
Trust: 0.1
sources:
            
            
            BID: 77626 // 
            
            
            
            JVNDB: JVNDB-2015-005981 // 
            
            
            
            PACKETSTORM: 136600 // 
            
            
            
            CNNVD: CNNVD-201511-298 // 
            
            
            
            NVD: CVE-2015-5255

REFERENCES
url:https://helpx.adobe.com/security/products/coldfusion/apsb15-29.html
Trust: 1.9
url:https://helpx.adobe.com/security/products/livecycleds/apsb15-30.html
Trust: 1.9
url:http://www.vmware.com/security/advisories/vmsa-2015-0008.html
Trust: 1.9
url:http://www.securityfocus.com/bid/77626
Trust: 1.6
url:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05073670
Trust: 1.6
url:http://packetstormsecurity.com/files/134506/apache-flex-blazeds-4.7.1-ssrf.html
Trust: 1.6
url:http://www.securityfocus.com/archive/1/536958/100/0/threaded
Trust: 1.6
url:http://www.securitytracker.com/id/1034210
Trust: 1.6
url:http://marc.info/?l=bugtraq&m=145996963420108&w=2
Trust: 1.6
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-5255
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-5255
Trust: 0.8
url:http://www.adobe.com/products/coldfusion/
Trust: 0.3
url:http://www.adobe.com
Trust: 0.3
url:http://www.adobe.com/devnet/livecycle/dataservices.html
Trust: 0.3
url:http://seclists.org/bugtraq/2015/nov/118
Trust: 0.3
url:https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05073670
Trust: 0.3
url:http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs16-005/index.html
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2015-5255
Trust: 0.1
url:https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_n
Trust: 0.1
url:http://www.hpe.com/support/subscriber_choice
Trust: 0.1
url:http://www.hpe.com/support/security_bulletin_archive
Trust: 0.1
sources:
            
            
            BID: 77626 // 
            
            
            
            JVNDB: JVNDB-2015-005981 // 
            
            
            
            PACKETSTORM: 136600 // 
            
            
            
            CNNVD: CNNVD-201511-298 // 
            
            
            
            NVD: CVE-2015-5255

CREDITS
James Kettle of PortSwigger Web Security
Trust: 0.3
sources:
            
            
            BID: 77626

SOURCES
db:BIDid:77626
db:JVNDBid:JVNDB-2015-005981
db:PACKETSTORMid:136600
db:CNNVDid:CNNVD-201511-298
db:NVDid:CVE-2015-5255

LAST UPDATE DATE
2024-08-14T13:31:33.415000+00:00

SOURCES UPDATE DATE
db:BIDid:77626date:2016-07-05T22:03:00
db:JVNDBid:JVNDB-2015-005981date:2016-03-24T00:00:00
db:CNNVDid:CNNVD-201511-298date:2020-10-22T00:00:00
db:NVDid:CVE-2015-5255date:2020-09-04T14:05:50.570

SOURCES RELEASE DATE
db:BIDid:77626date:2015-11-17T00:00:00
db:JVNDBid:JVNDB-2015-005981date:2015-11-20T00:00:00
db:PACKETSTORMid:136600date:2016-04-07T01:07:53
db:CNNVDid:CNNVD-201511-298date:2015-11-19T00:00:00
db:NVDid:CVE-2015-5255date:2015-11-18T21:59:00.130