What’s Vulnerable › Vulnerabilities

CVE-2009-3960: Adobe BlazeDS Information Disclosure Vulnerability

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-03-07
• EPSS: 90.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2010-02-15 · updated 2026-08-06

Description

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.

Affected products

• Adobe Blazeds: through 3.2
• Adobe ColdFusion: 7.0.2, 8.0, 8.0.1, 9.0
• Adobe Flex Data Services: 2.0.1
• Adobe Livecycle: 8.0.1, 8.2.1, 9.0
• Adobe Livecycle Data Services: 2.5.1, 2.6.1, 3.0

References

• http://secunia.com/advisories/38543
• http://securitytracker.com/id?1023584
• http://www.adobe.com/support/security/bulletins/apsb10-05.html
• http://www.osvdb.org/62292
• http://www.securityfocus.com/bid/38197
• https://www.exploit-db.com/exploits/41855/
• http://secunia.com/advisories/38543
• http://securitytracker.com/id?1023584
• http://www.adobe.com/support/security/bulletins/apsb10-05.html
• http://www.osvdb.org/62292
• http://www.securityfocus.com/bid/38197
• https://www.exploit-db.com/exploits/41855/

Get alerted when CVE-2009-3960 or the next vulnerability affects your stack