CVE-2009-3960
Adobe BlazeDS Information Disclosure Vulnerability
Published Feb 15, 2010 · updated Aug 5, 2026 · adobe blazeds
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
Timeline
Detection, updates, and resolution for this record.
Feb 15, 2010 · Catalog
Detected
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
Mar 7, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Sep 7, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Aug 5, 2026 · Catalog
Updated
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
Required action
Apply updates per vendor instructions.
CISA due date Sep 7, 2022
Affected
- cpe adobe/blazedsversion unspecified
- cpe adobe/coldfusion7.0.2
- cpe adobe/coldfusion8.0
- cpe adobe/coldfusion8.0.1
- cpe adobe/coldfusion9.0
- cpe adobe/flex data services2.0.1
- cpe adobe/livecycle8.0.1
- cpe adobe/livecycle8.2.1
- vendor Adobe BlazeDSversion unspecified
Sources
- CISA KEVCVE-2009-3960
Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.
cisa.gov - CVE.orgCVE-2009-3960
Official CVE identifier
cve.org - FIRST EPSSCVE-2009-3960
30-day exploitation probability 90.1%
first.org - Exploit Database11529
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database41855
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesauxiliary_scanner/http/adobe_xml_inject
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2009-3960
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vector
nvd.nist.gov