CVEvulnerability

CVE-2011-2092

10.0 HIGH Published 2011-06-16 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2011-06-16
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-20

Description

Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of classes during deserialization of (1) AMF and (2) AMFX data, which allows attackers to have an unspecified impact via unknown vectors, related to a "deserialization vulnerability."

Affected configurations

• adobe blazeds (<= 4.0.1) • adobe livecycle data services (<= 3.1) • adobe livecycle data services 2.5 • adobe livecycle data services 2.5.1 • adobe livecycle data services 2.6 • adobe livecycle data services 2.6.1 • adobe livecycle data services 3 • adobe livecycle (<= 9.0.0.2) • adobe livecycle 6.0 • adobe livecycle 7.0 • adobe livecycle 8.0.1 • adobe livecycle 8.0.1.1 • adobe livecycle 8.0.1.2 • adobe livecycle 8.2.1.3

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References