$ cve CVE-2009-3960 JSON

CVE-2009-3960 KEV EXPLOIT

6.5

MEDIUM · CVSS 3.1 · EPSS 90.1% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-09-07.

Description

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.

Scoring

CVSS	6.5 (MEDIUM, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS	90.12% — more likely to be exploited than 100% of all CVEs
On CISA KEV	yes — remediate by 2022-09-07
Public exploit	yes
Published	2010-02-15
Last modified	2026-08-06

CISA KEV

Name	Adobe BlazeDS Information Disclosure Vulnerability
Added	2022-03-07
Due	2022-09-07
Vendor / product	Adobe / BlazeDS
Ransomware use	known

Affected (5)

Vendor	Product
adobe	blazeds
adobe	coldfusion
adobe	flex data services
adobe	livecycle
adobe	livecycle data services

Public exploits

Source	Title	Date
exploit-db	Adobe (Multiple Products) - XML Injection File Content Disclosure	2017-04-07
exploit-db	Adobe (Multiple Products) - XML External Entity / XML Injection	2010-02-22

References

→ the Explorer · watch your stack · NVD