CVE-2009-3960
adobe blazeds, adobe coldfusion, adobe flex data services
Published 15 Feb 2010 · updated 6 Aug 2026 · Analyzed
Exploited in the wild
CISA added this to its Known Exploited Vulnerabilities catalog on 7 Mar 2022, with a remediation deadline of 7 Sept 2022 for US federal agencies. It has been used in ransomware campaigns.
Required action: Apply updates per vendor instructions.
Description
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
References
- secunia.com/advisories/38543 · Broken Link
- securitytracker.com/id?1023584 · Broken Link, Third Party Advisory, VDB Entry
- www.adobe.com/support/security/bulletins/apsb10-05.html · Not Applicable, Vendor Advisory
- www.osvdb.org/62292 · Broken Link
- www.securityfocus.com/bid/38197 · Broken Link, Third Party Advisory, VDB Entry
- www.exploit-db.com/exploits/41855/ · Exploit, Third Party Advisory, VDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960 · US Government Resource