CVE-2011-2092

Published: Jun 16, 2011Modified: Apr 29, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of classes during deserialization of (1) AMF and (2) AMFX data, which allows attackers to have an unspecified impact via unknown vectors, related to a "deserialization vulnerability."

Affected (14)

Products: Adobe: Blazeds, Livecycle Data Services, Livecycle

Adobe

3 products

Blazeds

Livecycle Data Services

Livecycle

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Adobe Blazeds	Up to 4.0.1

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Adobe Livecycle Data Services	Up to 3.1
Adobe Livecycle Data Services	Version 2.5.1
Adobe Livecycle Data Services	Version 2.5
Adobe Livecycle Data Services	Version 2.6.1
Adobe Livecycle Data Services	Version 2.6
Adobe Livecycle Data Services	Version 3

Configuration C

7 vulnerable

Vulnerable Software	Affected Versions
Adobe Livecycle	Up to 9.0.0.2
Adobe Livecycle	Version 6.0
Adobe Livecycle	Version 7.0
Adobe Livecycle	Version 8.0.1.1
Adobe Livecycle	Version 8.0.1.2
Adobe Livecycle	Version 8.0.1
Adobe Livecycle	Version 8.2.1.3