CNVD-2015-07736

Vulnerability from cnvd - Published: 2015-11-23
VLAI
Title
多个Adobe产品服务器端请求伪造安全绕过漏洞
Description
Adobe ColdFusion是一个动态Web服务器,其CFML是一种程序设计语言,类似现在的JSP里的JSTL。Adobe LiveCycle Data Services是美国奥多比（Adobe）公司的一套部署在应用服务器上并整合了RIA应用和J2EE等企业应用的服务器软件。 多个Adobe产品存在服务器端请求伪造安全绕过漏洞。允许远程攻击者利用此漏洞绕过某些安全限制执行未授权操作。
Severity
中
Patch Name
多个Adobe产品服务器端请求伪造安全绕过漏洞的补丁
Patch Description
Adobe ColdFusion是一个动态Web服务器,其CFML是一种程序设计语言,类似现在的JSP里的JSTL。 Adobe LiveCycle Data Services是美国奥多比（Adobe）公司的一套部署在应用服务器上并整合了RIA应用和J2EE等企业应用的服务器软件。 多个Adobe产品存在服务器端请求伪造安全绕过漏洞。允许远程攻击者利用此漏洞绕过某些安全限制执行未授权操作。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

用户可联系供应商获得补丁信息： http://www.adobe.com/ http://www.adobe.com/products/coldfusion-family.html

Reference
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5255 http://www.securityfocus.com/bid/77626
Impacted products
Name
['Adobe ColdFusion 10(<Update 18)', 'Adobe ColdFusion 11(<Update 7)', 'Adobe LiveCycle Data Services 3.0', 'Adobe LiveCycle Data Services \r\n4.5', 'Adobe LiveCycle Data Services \r\n4.6', 'Adobe LiveCycle Data Services \r\n4.7']
Show details on source website
To clipboard 

{
  "bids": {
    "bid": {
      "bidNumber": "77626"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-5255"
    }
  },
  "description": "Adobe ColdFusion\u662f\u4e00\u4e2a\u52a8\u6001Web\u670d\u52a1\u5668,\u5176CFML\u662f\u4e00\u79cd\u7a0b\u5e8f\u8bbe\u8ba1\u8bed\u8a00,\u7c7b\u4f3c\u73b0\u5728\u7684JSP\u91cc\u7684JSTL\u3002Adobe LiveCycle Data Services\u662f\u7f8e\u56fd\u5965\u591a\u6bd4\uff08Adobe\uff09\u516c\u53f8\u7684\u4e00\u5957\u90e8\u7f72\u5728\u5e94\u7528\u670d\u52a1\u5668\u4e0a\u5e76\u6574\u5408\u4e86RIA\u5e94\u7528\u548cJ2EE\u7b49\u4f01\u4e1a\u5e94\u7528\u7684\u670d\u52a1\u5668\u8f6f\u4ef6\u3002\r\n\r\n\u591a\u4e2aAdobe\u4ea7\u54c1\u5b58\u5728\u670d\u52a1\u5668\u7aef\u8bf7\u6c42\u4f2a\u9020\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\u3002\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u5229\u7528\u6b64\u6f0f\u6d1e\u7ed5\u8fc7\u67d0\u4e9b\u5b89\u5168\u9650\u5236\u6267\u884c\u672a\u6388\u6743\u64cd\u4f5c\u3002",
  "discovererName": "James Kettle of PortSwigger Web Security",
  "formalWay": "\u7528\u6237\u53ef\u8054\u7cfb\u4f9b\u5e94\u5546\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttp://www.adobe.com/\r\nhttp://www.adobe.com/products/coldfusion-family.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-07736",
  "openTime": "2015-11-23",
  "patchDescription": "Adobe ColdFusion\u662f\u4e00\u4e2a\u52a8\u6001Web\u670d\u52a1\u5668,\u5176CFML\u662f\u4e00\u79cd\u7a0b\u5e8f\u8bbe\u8ba1\u8bed\u8a00,\u7c7b\u4f3c\u73b0\u5728\u7684JSP\u91cc\u7684JSTL\u3002\r\nAdobe LiveCycle Data Services\u662f\u7f8e\u56fd\u5965\u591a\u6bd4\uff08Adobe\uff09\u516c\u53f8\u7684\u4e00\u5957\u90e8\u7f72\u5728\u5e94\u7528\u670d\u52a1\u5668\u4e0a\u5e76\u6574\u5408\u4e86RIA\u5e94\u7528\u548cJ2EE\u7b49\u4f01\u4e1a\u5e94\u7528\u7684\u670d\u52a1\u5668\u8f6f\u4ef6\u3002\r\n\r\n\u591a\u4e2aAdobe\u4ea7\u54c1\u5b58\u5728\u670d\u52a1\u5668\u7aef\u8bf7\u6c42\u4f2a\u9020\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\u3002\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u5229\u7528\u6b64\u6f0f\u6d1e\u7ed5\u8fc7\u67d0\u4e9b\u5b89\u5168\u9650\u5236\u6267\u884c\u672a\u6388\u6743\u64cd\u4f5c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u4e2aAdobe\u4ea7\u54c1\u670d\u52a1\u5668\u7aef\u8bf7\u6c42\u4f2a\u9020\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Adobe ColdFusion 10(\u003cUpdate 18)",
      "Adobe ColdFusion  11(\u003cUpdate 7)",
      "Adobe LiveCycle Data Services 3.0",
      "Adobe LiveCycle Data Services \r\n4.5",
      "Adobe LiveCycle Data Services \r\n4.6",
      "Adobe LiveCycle Data Services \r\n4.7"
    ]
  },
  "referenceLink": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5255\r\nhttp://www.securityfocus.com/bid/77626",
  "serverity": "\u4e2d",
  "submitTime": "2015-11-19",
  "title": "\u591a\u4e2aAdobe\u4ea7\u54c1\u670d\u52a1\u5668\u7aef\u8bf7\u6c42\u4f2a\u9020\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.