CVE-2011-2092
Severity CVSS v4.0:
Pending analysis
Type:
CWE-20
Input Validation
Publication date:
16/06/2011
Last modified:
11/04/2025
Description
Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of classes during deserialization of (1) AMF and (2) AMFX data, which allows attackers to have an unspecified impact via unknown vectors, related to a "deserialization vulnerability."
Impact
Base Score 2.0
10.00
Severity 2.0
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:adobe:blazeds:*:*:*:*:*:*:*:* | 4.0.1 (including) | |
| cpe:2.3:a:adobe:livecycle_data_services:*:*:*:*:*:*:*:* | 3.1 (including) | |
| cpe:2.3:a:adobe:livecycle_data_services:2.5:*:*:*:*:*:*:* | ||
| cpe:2.3:a:adobe:livecycle_data_services:2.5.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:adobe:livecycle_data_services:2.6:*:*:*:*:*:*:* | ||
| cpe:2.3:a:adobe:livecycle_data_services:2.6.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:adobe:livecycle_data_services:3:*:*:*:*:*:*:* | ||
| cpe:2.3:a:adobe:livecycle:*:*:*:*:*:*:*:* | 9.0.0.2 (including) | |
| cpe:2.3:a:adobe:livecycle:6.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:adobe:livecycle:7.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:adobe:livecycle:8.0.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:adobe:livecycle:8.0.1.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:adobe:livecycle:8.0.1.2:*:*:*:*:*:*:* | ||
| cpe:2.3:a:adobe:livecycle:8.2.1.3:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page