← Vulnerability feed

Vulnerability record · CVE-2015-3269 · published 25 August 2015

CVE-2015-3269: Hp business service management information exposure vulnerability

Hp · Business Service Management

Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before 4.7.0.354169 and other products, allows remote attackers to read arbitrary files via an AMF message containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

5.0 CVSS 2.0 Medium EPSS 9.8% · top 4.6% CWE-200 · Information exposure
5.0CVSS 2.0 base score
9.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
18References
17 Jun 2026Last modified by NVD

Description

Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before 4.7.0.354169 and other products, allows remote attackers to read arbitrary files via an AMF message containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://marc.info/?l=bugtraq&m=145706712500978&w=2 Third Party Advisory
http://www.securityfocus.com/archive/1/536266/100/0/threaded
http://www.securityfocus.com/bid/76394
http://www.securitytracker.com/id/1033337
http://www.vmware.com/security/advisories/VMSA-2015-0008.html
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05026202 Third Party Advisory
https://helpx.adobe.com/content/help/en/security/products/coldfusion/apsb15-21.html
https://helpx.adobe.com/security/products/livecycleds/apsb15-20.html PatchVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-508/
http://marc.info/?l=bugtraq&m=145706712500978&w=2 Third Party Advisory
http://www.securityfocus.com/archive/1/536266/100/0/threaded
http://www.securityfocus.com/bid/76394
http://www.securitytracker.com/id/1033337
http://www.vmware.com/security/advisories/VMSA-2015-0008.html
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05026202 Third Party Advisory
https://helpx.adobe.com/content/help/en/security/products/coldfusion/apsb15-21.html
https://helpx.adobe.com/security/products/livecycleds/apsb15-20.html PatchVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-508/

Track CVE-2015-3269 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.5CVE-2009-3960Adobe BlazeDS XML External Entity Information DisclosureBlazeDS 3.2 and earlier, along with related LiveCycle, LiveCycle Data Services, Flex Data Services, and ColdFusion versions, mishandles XML documents…KEVEPSS 90%analysed10.0CVE-2012-2561Hp business service management permissions and access controls vulnerabilityHP Business Service Management (BSM) 9.12 does not properly restrict the uploading of .war files, which allows remote attackers to execute arbitrary …EPSS 8.6%10.0CVE-2011-2092Adobe blazeds improper input validation vulnerabilityAdobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of clas…EPSS 6.1%8.8CVE-2016-4405Hp business service management deserialization of untrusted data vulnerabilityA remote code execution vulnerability was identified in HP Business Service Management (BSM) using Apache Commons Collection Java Deserialization ver…EPSS 4.8%5.4CVE-2016-4392Hp business service management cross-site scripting vulnerabilityA remote cross site scripting vulnerability has been identified in HP Business Service Management software v9.1x, v9.20 - v9.25IP1.EPSS 1.1%5.0CVE-2011-2093Adobe blazeds improper input validation vulnerabilityAdobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly handle object graphs, whi…EPSS 3.8%4.3CVE-2015-5255Hp xp p9000 command view advanced edition improper input validation vulnerabilityAdobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3…EPSS 4.5%4.3CVE-2011-0274Hp business availability center cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 7.x through 7.55 and 8.x through 8.05, and Business Service Managem…EPSS 2.1%

Source: NIST National Vulnerability Database (record CVE-2015-3269), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.