CVE-2009-3960mediumunder attackransomware

CVE-2009-3960

Published · Updated

Follow this CVE+ Monitor BlazeDS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 6.5epss 90%
from disclosure to weapon7 days
Published on NVDFeb 15
1st PoC+7d
CISA KEV+4403d
Action required by CISAfederal deadline: 2022-09-07

Apply updates per vendor instructions.

In short

BlazeDS and related Adobe products contain a vulnerability that allows attackers to extract sensitive information by manipulating XML requests with injected tags and external entity references. This could expose confidential data if an attacker sends a specially crafted request to the affected system.

Technical detail

An unspecified vulnerability in BlazeDS 3.2 and earlier versions (affecting LiveCycle, Flex Data Services, and ColdFusion) permits remote attackers to retrieve sensitive information through XML external entity (XXE) injection and tag injection vectors. The attack requires sending a malformed XML request but does not necessitate authentication, allowing information disclosure.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.