← CVE Radar
CVE-2009-3960Adobe BlazeDS Information Disclosure Vulnerability
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
6.5 MEDIUMEPSS 90.11%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 6.5 | MEDIUM | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| 4.3 | MEDIUM | 2.0NVD | AV:N/AC:M/Au:N/C:P/I:N/A:N |
CISA required action
⚡ Known exploited · remediation due Sep 7, 2022
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2009-3960
- Status
- Analyzed
- Assigner (CNA)
- adobe
- Published
- Feb 15, 2010
- Last modified
- 2026-08-06 05:16 UTC
Affected Products
From NVD CPE configurations.
adobeblazeds1 version range
- through 3.2
adobecoldfusion4 version ranges
- 7.0.2
- 8.0
- 8.0.1
- 9.0
adobeflex data services1 version range
- 2.0.1
adobelivecycle3 version ranges
- 8.0.1
- 8.2.1
- 9.0
adobelivecycle data services3 version ranges
- 2.5.1
- 2.6.1
- 3.0
References
- secunia.com http://secunia.com/advisories/38543
- securitytracker.com http://securitytracker.com/id?1023584
- adobe.com http://www.adobe.com/support/security/bulletins/apsb10-05.html
- osvdb.org http://www.osvdb.org/62292
- securityfocus.com http://www.securityfocus.com/bid/38197
- exploit-db.com https://www.exploit-db.com/exploits/41855/
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960