{"id":"CVE-2009-3960","url":"https://www.cyber-defence.io/tools/cve/CVE-2009-3960","generatedAt":"2026-10-31T23:41:51.394Z","title":"Adobe BlazeDS Information Disclosure Vulnerability","description":"Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.","published":"2010-02-15T18:30:00.000Z","lastModified":"2026-08-06T05:16:33.000Z","status":"Analyzed","sourceIdentifier":"psirt@adobe.com","cvss":{"version":"3.1","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},"cwe":[],"affected":["adobe/blazeds","adobe/coldfusion","adobe/flex data services","adobe/livecycle","adobe/livecycle data services"],"epss":{"score":0.90118,"percentile":0.99795,"date":"2026-10-30","history":[]},"kev":{"listed":true,"dateAdded":"2022-03-07","dueDate":"2022-09-07","knownRansomwareCampaignUse":"Known","notes":"Apply updates per vendor instructions.\nhttps://nvd.nist.gov/vuln/detail/CVE-2009-3960"},"exploits":{"count":2,"verified":true,"firstPublished":"2010-02-22","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":41855,"kind":"exploit","title":"Adobe (Multiple Products) - XML Injection File Content Disclosure","url":"https://www.exploit-db.com/exploits/41855","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/xml/webapps/41855.sh","file":"exploits/xml/webapps/41855.sh","published":"2017-04-07","added":"2017-04-11","updated":"2017-09-18","author":"Tess Sluyter","type":"webapps","platform":"xml","port":8400,"verified":false,"codes":["CVE-2009-3960"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://github.com/tsluyter/exploits/blob/50229fd73a5dc60edce0c833dfb8248251467470/adobe_xml_inject.sh"},{"edbId":11529,"kind":"exploit","title":"Adobe (Multiple Products) - XML External Entity / XML Injection","url":"https://www.exploit-db.com/exploits/11529","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/dos/11529.txt","file":"exploits/multiple/dos/11529.txt","published":"2010-02-22","added":"2010-02-21","updated":null,"author":"Roberto Suggi Liverani","type":"dos","platform":"multiple","port":null,"verified":true,"codes":["CVE-2009-3960","OSVDB-62292"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"http://www.security-assessment.com/files/advisories/2010-02-22_Multiple_Adobe_Products-XML_External_Entity_and_XML_Injection.pdf"}]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 7 September 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"http://secunia.com/advisories/38543","tags":["Broken Link"],"source":"psirt@adobe.com"},{"url":"http://securitytracker.com/id?1023584","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"psirt@adobe.com"},{"url":"http://www.adobe.com/support/security/bulletins/apsb10-05.html","tags":["Not Applicable","Vendor Advisory"],"source":"psirt@adobe.com"},{"url":"http://www.osvdb.org/62292","tags":["Broken Link"],"source":"psirt@adobe.com"},{"url":"http://www.securityfocus.com/bid/38197","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"psirt@adobe.com"},{"url":"https://www.exploit-db.com/exploits/41855/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"psirt@adobe.com"},{"url":"http://secunia.com/advisories/38543","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://securitytracker.com/id?1023584","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.adobe.com/support/security/bulletins/apsb10-05.html","tags":["Not Applicable","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.osvdb.org/62292","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/38197","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/41855/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960","tags":["US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2009-3960","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}