CVE-2009-3960

CVE-2009-3960 is a medium-severity (CVSS 6.5) vulnerability in Adobe BlazeDS. CISA added it to the Known Exploited Vulnerabilities catalog on March 7, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 7, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Adobe has 83 vulnerabilities in the KEV catalog, 11 of them linked to ransomware.

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

• http://secunia.com/advisories/38543
• http://securitytracker.com/id?1023584
• http://www.adobe.com/support/security/bulletins/apsb10-05.html
• http://www.osvdb.org/62292
• http://www.securityfocus.com/bid/38197
• https://www.exploit-db.com/exploits/41855/
• http://secunia.com/advisories/38543
• http://securitytracker.com/id?1023584