{"id":"CVE-2009-3960","aliases":["EUVD-2009-3931","GHSA-5wf6-gpr3-53cq"],"status":"published","title":"Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0,...","description":"Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.90118,"percentile":0.99798,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"published":"2010-02-15T18:00:00Z","modified":"2026-08-06T05:16:33Z","kev":{"date_added":"2022-03-07","due_date":"2022-09-07","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-03-07"},{"source":"kev","since":"2022-03-07"}],"exploits":[{"source":"exploitdb","id":"EDB-11529","title":"Adobe (Multiple Products) - XML External Entity / XML Injection","type":"dos","platform":"multiple","date":"2010-02-22","verified":true,"url":"https://www.exploit-db.com/exploits/11529"},{"source":"exploitdb","id":"EDB-41855","title":"Adobe (Multiple Products) - XML Injection File Content Disclosure","type":"webapps","platform":"xml","date":"2017-04-07","url":"https://www.exploit-db.com/exploits/41855"},{"source":"metasploit","id":"auxiliary/scanner/http/adobe_xml_inject","title":"Adobe XML External Entity Injection","type":"auxiliary","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/adobe_xml_inject"}],"products":[{"vendor":"adobe","product":"blazeds"},{"vendor":"adobe","product":"coldfusion"},{"vendor":"adobe","product":"flex_data_services"},{"vendor":"adobe","product":"livecycle"},{"vendor":"adobe","product":"livecycle_data_services"}],"references":[{"url":"http://www.securityfocus.com/bid/38197","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://securitytracker.com/id?1023584","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.osvdb.org/62292","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Broken Link"]},{"url":"http://secunia.com/advisories/38543","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"https://www.exploit-db.com/exploits/41855/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb10-05.html","tags":["x_refsource_CONFIRM","x_transferred","Not Applicable","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3960"},{"url":"https://www.exploit-db.com/exploits/41855"},{"url":"https://github.com/advisories/GHSA-5wf6-gpr3-53cq"}],"sources":{"cve":[{"id":"CVE-2009-3960","description":"Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.","status":"published","published":"2010-02-15T18:00:00Z","modified":"2026-08-06T03:55:29.278Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:33:24.10565Z"}],"euvd":[{"id":"EUVD-2009-3931","description":"Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.","status":"published","published":"2010-02-15T18:00:00Z","modified":"2026-08-06T03:55:29Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"exploited_since":"2022-03-07","updated_at":"2026-11-02T18:02:09.043832Z"}],"ghsa":[{"id":"GHSA-5wf6-gpr3-53cq","title":"Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0,...","description":"Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.","status":"published","published":"2022-05-02T03:50:11Z","modified":"2025-10-22T03:31:12Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:04:09.843024Z"}],"kev":[{"id":"CVE-2009-3960","title":"Adobe BlazeDS Information Disclosure Vulnerability","description":"Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.","kev":{"date_added":"2022-03-07","due_date":"2022-09-07","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2009-3960","description":"Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.","status":"published","published":"2010-02-15T18:30:00.407Z","modified":"2026-08-06T05:16:33.473Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:01:38.33745Z"}]}}