CVE-2009-3960KEV · OVERDUE

Adobe BlazeDS Information Disclosure Vulnerability

Medium · published February 15, 2010

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 6.5. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.

1506
days past CISA
deadline
CVSS v3.1
6.5
EPSS
90%
Percentile
99.8
In the wild
Confirmed
What it is

⚠️ A sneaky vulnerability in BlazeDS allows attackers to poke around in sensitive data—talk about an unwelcome visitor! 🔍 Think of it like a restaurant that accidentally lets diners peek into the kitchen, where all the behind-the-scenes secrets are stored. Just like you wouldn't want your recipes exposed, the same goes for your XML documents! If exploited, an attacker could gain unauthorized access to sensitive information, potentially leading to data breaches or misuse of your system's resources. This could be particularly damaging for organizations handling confidential data, making it essential to address this vulnerability quickly.

Put simply

Think of it like a restaurant that accidentally lets diners peek into the kitchen, where all the behind-the-scenes secrets are stored. Just like you wouldn't want your recipes exposed, the same goes for your XML documents! This issue arises from improper handling of XML documents, where injected tags and external entity references can allow attackers to extract sensitive information via crafted requests, affecting multiple Adobe products including BlazeDS and ColdFusion.

What to do

If exploited, an attacker could gain unauthorized access to sensitive information, potentially leading to data breaches or misuse of your system's resources. This could be particularly damaging for organizations handling confidential data, making it essential to address this vulnerability quickly. To remediate, upgrade BlazeDS to version 3.2 or later and ensure you're running the latest versions of LiveCycle and ColdFusion. Regularly audit your XML handling to prevent similar issues in the future. 🛡️ You've got this! Take action now, and you'll be well on your way to securing your applications! 🔒

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.90118 · 99.8th percentile
Published
2010-02-15T23:30Z
KEV added
2022-03-07 · due 2022-09-07
Affected products (12)
ProductVersionsFixed in
adobe/blazeds≤ 3.2—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/flex_data_servicesall versions—
adobe/livecycleall versions—
adobe/livecycleall versions—
adobe/livecycleall versions—
adobe/livecycle_data_servicesall versions—
adobe/livecycle_data_servicesall versions—
adobe/livecycle_data_servicesall versions—
References (13)
EPSS history
Timeline
  • 07 MAR 00:00Z
    Added to CISA KEV — remediate by Sep 7
    kev
  • 15 FEB 18:00Z
    Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data…
    cvelistv5