CVE-2011-2092
Status: ModifiedHigh (10)—
Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of classes during deserialization of (1) AMF and (2) AMFX data, which allows attackers to have an unspecified impact via unknown vectors, related to a "deserialization vulnerability."
CVSS
- Version: 2.0
- Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
- Base score: 10
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 6.06%
- Percentile among all scored CVEs: 93
- Score date: 10/5/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (3)
CWEs
- CWE-20
References
Raw JSON (NVD)
Show
{
"id": "CVE-2011-2092",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 10,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "psirt@adobe.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2011-06-16T23:55:01.527",
"references": [
{
"url": "http://www.adobe.com/support/security/bulletins/apsb11-15.html",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "psirt@adobe.com"
},
{
"url": "http://www.securitytracker.com/id?1025656",
"source": "psirt@adobe.com"
},
{
"url": "http://www.securitytracker.com/id?1025657",
"source": "psirt@adobe.com"
},
{
"url": "http://www.adobe.com/support/security/bulletins/apsb11-15.html",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id?1025656",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id?1025657",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-20"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of classes during deserialization of (1) AMF and (2) AMFX data, which allows attackers to have an unspecified impact via unknown vectors, related to a \"deserialization vulnerability.\""
},
{
"lang": "es",
"value": "Adobe LiveCycle Data Services v3.1 y anteriores, LiveCycle v9.0.0.2 y anteriores, y BlazeDS v4.0.1 y anteriores no restringen adecuadamente la creación de clases durante la deserialización de la informción (1) AMF y (2) AMFX, lo que permite a atacantestener un impacto no especificado a través de vectores desconocidos."
}
],
"lastModified": "2026-06-16T23:30:40.633",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:blazeds:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "007166D5-D7B0-486C-B4B6-C239906EF8D3",
"versionEndIncluding": "4.0.1"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:livecycle_data_services:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3FA36866-F153-47DE-871E-D92DBD8A1C2B",
"versionEndIncluding": "3.1"
},
{
"criteria": "cpe:2.3:a:adobe:livecycle_data_services:2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "289238E6-C234-4191-911C-C6F0E51A3E1D"
},
{
"criteria": "cpe:2.3:a:adobe:livecycle_data_services:2.5.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "262ED6C7-3C78-4863-9056-A9D55C7DB6CC"
},
{
"criteria": "cpe:2.3:a:adobe:livecycle_data_services:2.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8606C261-650F-43AF-BE2D-52DACFB94BBC"
},
{
"criteria": "cpe:2.3:a:adobe:livecycle_data_services:2.6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BEFE9CD7-0DB5-4038-AFB5-1B756186605C"
},
{
"criteria": "cpe:2.3:a:adobe:livecycle_data_services:3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "37973B36-6229-498A-936E-D621E2ED90C6"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:livecycle:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9E1BE8C5-F3EA-4F74-8ABE-BB5A7127DED3",
"versionEndIncluding": "9.0.0.2"
},
{
"criteria": "cpe:2.3:a:adobe:livecycle:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "123AE8CC-080C-4684-9818-CCEC5ACC1E60"
},
{
"criteria": "cpe:2.3:a:adobe:livecycle:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D59B6009-B1B1-4FE1-8330-777473CF9EEA"
},
{
"criteria": "cpe:2.3:a:adobe:livecycle:8.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3890CE6C-D8D0-4406-ACE1-9849CFCA72F4"
},
{
"criteria": "cpe:2.3:a:adobe:livecycle:8.0.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "55624316-BCFD-4555-92F0-EF5271B86081"
},
{
"criteria": "cpe:2.3:a:adobe:livecycle:8.0.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "89AE5D48-8552-4DB5-97A3-4D401559AB81"
},
{
"criteria": "cpe:2.3:a:adobe:livecycle:8.2.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D2C91FA2-9DBB-4B06-8DBF-D7951A947087"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "psirt@adobe.com"
}