CVE-2011-2092 json
Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creati…
published 2011-06-16 15 y ago modified 2026-06-16 4 mo ago also EUVD-2011-2084
- cvss
- 10.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 6.1%
- EPSS 6.1% chance of exploitation in 30 days, percentile 93%
- public exploits
- 0
- none known
Summary
Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of classes during deserialization of (1) AMF and (2) AMFX data, which allows attackers to have an unspecified impact via unknown vectors, related to a "deserialization vulnerability."
Patch / fix
Exploit prediction
6.06% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
adobe.com
/support/security/bulletins/apsb11-15.html
patch, vendor-advisory
-
securitytracker.com
/id?1025656
vdb-entry
-
securitytracker.com
/id?1025657
vdb-entry
Sources
- CVE List CVE-2011-2092
- NVD CVE-2011-2092
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.