medium6.5Known exploitedPublic exploit code
CVE-2009-3960
Adobe BlazeDS Information Disclosure Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-03-07. Federal due date: 2022-09-07.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Adobe (Multiple Products) - XML External Entity / XML Injection2010-02-22 · dos · multiple · Verified
- Adobe (Multiple Products) - XML Injection File Content Disclosure2017-04-07 · webapps · xml
Impact
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Adobe | Blazeds | through 3.2 |
| Adobe | Coldfusion | Versions 7.0.2, 8.0, 8.0.1, 9.0 |
| Adobe | Flex Data Services | Version 2.0.1 |
| Adobe | Livecycle | Versions 8.0.1, 8.2.1, 9.0 |
| Adobe | Livecycle Data Services | Versions 2.5.1, 2.6.1, 3.0 |
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://secunia.com/advisories/38543
- http://securitytracker.com/id?1023584
- http://www.adobe.com/support/security/bulletins/apsb10-05.html
- http://www.osvdb.org/62292
- http://www.securityfocus.com/bid/38197
- https://www.exploit-db.com/exploits/41855/
- http://secunia.com/advisories/38543
- http://securitytracker.com/id?1023584
- http://www.adobe.com/support/security/bulletins/apsb10-05.html
- http://www.osvdb.org/62292
- http://www.securityfocus.com/bid/38197
- https://www.exploit-db.com/exploits/41855/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960