PT-2015-3384 · Apache · Apache Flex Blazeds
Kpc
·
Published
2015-08-25
·
Updated
2022-03-11
·
CVE-2015-3269
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Flex BlazeDS versions 3.0.x through 3.0.0.354170
Apache Flex BlazeDS versions 4.5 through 4.5.1.354169
Apache Flex BlazeDS versions 4.6.2 through 4.6.2.354169
Apache Flex BlazeDS versions 4.7 through 4.7.0.354169
Description
The issue allows remote attackers to read arbitrary files via an AMF message containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. This can enable an attacker to view the contents of any file on the server or perform network scanning of internal and external infrastructure.
Recommendations
For versions 3.0.x through 3.0.0.354170, update to version 3.0.0.354170 or later.
For versions 4.5 through 4.5.1.354169, update to version 4.5.1.354169 or later.
For versions 4.6.2 through 4.6.2.354169, update to version 4.6.2.354169 or later.
For versions 4.7 through 4.7.0.354169, update to version 4.7.0.354169 or later.
As a temporary workaround, consider restricting access to the XML external entity processing functionality until a patch is available.
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Flex Blazeds