Description

Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of classes during deserialization of (1) AMF and (2) AMFX data, which allows attackers to have an unspecified impact via unknown vectors, related to a "deserialization vulnerability."

Remediation

References

http://www.adobe.com/support/security/bulletins/apsb11-15.html

http://www.securitytracker.com/id?1025656

http://www.securitytracker.com/id?1025657

Related Vulnerabilities

CVE-2020-26870 Vulnerability in maven package org.webjars.bowergithub.cure53:dompurify

CVE-2022-22969 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth

CVE-2016-10735 Vulnerability in maven package ru.taskurotta:bootstrap

CVE-2023-34466 Vulnerability in maven package org.xwiki.platform:xwiki-platform-tag-api

CVE-2019-10754 Vulnerability in maven package org.apereo.cas:cas-server-support-oauth-core-api

Severity

Critical

Tags

Patch Vendor Advisory CWE-20