What is the CVSS score of CVE-2015-5255?

CVE-2015-5255 has a CVSS 2.0 base score of 4.3 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. EPSS exploitation probability: 2.9%.

Is there a patch available for CVE-2015-5255?

Yes, a patch is available for CVE-2015-5255. Update the affected software to the latest version immediately.

Xp P9000 Command View Advanced Edition CVE-2015-5255

MEDIUM

Improper Input Validation (CWE-20)

2015-11-18 secalert@redhat.com

Adobe SSRF Xp P9000 Command View Advanced Edition Xp7 Command View Advanced Edition Coldfusion Livecycle Data Services

4.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:N/I:P/A:N

Attack Vector

Network

Attack Complexity

Confidentiality

None

Integrity

Availability

None

Lifecycle Timeline

CVE Published

Nov 18, 2015 - 21:59 cve.org

MEDIUM 4.3

DescriptionCVE.org

Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-20. Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue. Affected products include: Hp Xp P9000 Command View Advanced Edition, Hp Xp7 Command View Advanced Edition, Adobe Coldfusion, Adobe Livecycle Data Services. Version information: before 3.0.0.354175.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.