CVE-2009-3960: Adobe BlazeDS Information Disclosure Vulnerability

Description

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)90.1% · higher than 100% of CVEs

Exploited in the wildYes

CISA KEVListed Mar 7, 2022

Federal remediation dueSep 7, 2022

Ransomware campaign useKnown

Affected products

Which versions

CO

ColdFusion · Adobe

7.0.2; 8.0; 8.0.1; 9.0 · source: NVD

BL

Blazeds · Adobe

through 3.2 · source: NVD, KEV

FD

Flex Data Services · Adobe

2.0.1 · source: NVD

LI

Livecycle · Adobe

8.0.1; 8.2.1; 9.0 · source: NVD

LD

Livecycle Data Services · Adobe

2.5.1; 2.6.1; 3.0 · source: NVD