CVE-2009-3960 : Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.

Published 2010-02-15 18:30:00

Updated 2024-07-16 17:43:31

Source Adobe Systems Incorporated

View at NVD, CVE.org

Products affected by CVE-2009-3960

Adobe » Coldfusion » Version: 7.0.2
cpe:2.3:a:adobe:coldfusion:7.0.2:*:*:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 8.0
cpe:2.3:a:adobe:coldfusion:8.0:*:*:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 8.0.1
cpe:2.3:a:adobe:coldfusion:8.0.1:*:*:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 9.0
cpe:2.3:a:adobe:coldfusion:9.0:*:*:*:*:*:*:*
Matching versions
Adobe » Lifecycle » Version: 8.2.1
cpe:2.3:a:adobe:lifecycle:8.2.1:*:*:*:*:*:*:*
Matching versions
Adobe » Lifecycle » Version: 9.0
cpe:2.3:a:adobe:lifecycle:9.0:*:*:*:*:*:*:*
Matching versions
Adobe » Lifecycle » Version: 8.0.1
cpe:2.3:a:adobe:lifecycle:8.0.1:*:*:*:*:*:*:*
Matching versions
Adobe » Lifecycle Data Services » Version: 3.0
cpe:2.3:a:adobe:lifecycle_data_services:3.0:*:*:*:*:*:*:*
Matching versions
Adobe » Lifecycle Data Services » Version: 2.5.1
cpe:2.3:a:adobe:lifecycle_data_services:2.5.1:*:*:*:*:*:*:*
Matching versions
Adobe » Lifecycle Data Services » Version: 2.6.1
cpe:2.3:a:adobe:lifecycle_data_services:2.6.1:*:*:*:*:*:*:*
Matching versions
Adobe » Flex Data Services » Version: 2.0.1
cpe:2.3:a:adobe:flex_data_services:2.0.1:*:*:*:*:*:*:*
Matching versions
Adobe » Blazeds
Versions up to, including, (<=) 3.2
cpe:2.3:a:adobe:blazeds:*:*:*:*:*:*:*:*
Matching versions

CVE-2009-3960 is in the CISA Known Exploited Vulnerabilities Catalog

This issue is known to have been leveraged as part of a ransomware campaign.

CISA vulnerability name:

Adobe BlazeDS Information Disclosure Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2009-3960

Added on 2022-03-07 Action due date 2022-09-07

Exploit prediction scoring system (EPSS) score for CVE-2009-3960

EPSS FAQ

94.55%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2009-3960

Adobe XML External Entity Injection

First seen: 2020-04-26

auxiliary/scanner/http/adobe_xml_inject

Multiple Adobe Products -- XML External Entity Injection. Affected Software: BlazeDS 3.2 and earlier versions, LiveCycle 9.0, 8.2.1, and 8.0.1, LiveCycle Data Services 3.0, 2.6.1, and 2.5.1, Flex Data Services 2.0.1, ColdFusion 9.0, 8.0.1, 8.0, and 7.0.2 Authors:

More information

CVSS scores for CVE-2009-3960

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	2.8	3.6	NIST	2024-07-16
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: None Availability: None

References for CVE-2009-3960

http://www.securityfocus.com/bid/38197

Adobe BlazeDS XML and XML External Entity Injection Vulnerabilities
Broken Link;Third Party Advisory;VDB Entry
http://secunia.com/advisories/38543

About Secunia Research | Flexera
Broken Link
https://www.exploit-db.com/exploits/41855/

Adobe (Multiple Products) - XML Injection File Content Disclosure - XML webapps Exploit
Exploit;Third Party Advisory;VDB Entry
http://www.adobe.com/support/security/bulletins/apsb10-05.html

Adobe - Security Bulletins: APSB10-05 Security update available for BlazeDS
Not Applicable;Vendor Advisory
http://securitytracker.com/id?1023584

GoDaddy Domain Name Search
Broken Link;Third Party Advisory;VDB Entry
http://www.osvdb.org/62292

404 Not Found
Broken Link

Jump to