{"id":"CVE-2009-3960","title":"Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers…","summary":"Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","vendor":"adobe","product":"blazeds","affected":["blazeds <= 3.2","coldfusion = 7.0.2","coldfusion = 8.0","coldfusion = 8.0.1","coldfusion = 9.0","flex_data_services = 2.0.1","livecycle = 8.0.1","livecycle = 8.2.1","livecycle = 9.0","livecycle_data_services = 2.5.1","livecycle_data_services = 2.6.1","livecycle_data_services = 3.0"],"published":"2010-02-15","updated":"2026-08-01","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2009-3960","references":[{"url":"http://secunia.com/advisories/38543","label":"psirt@adobe.com"},{"url":"http://securitytracker.com/id?1023584","label":"psirt@adobe.com"},{"url":"http://www.adobe.com/support/security/bulletins/apsb10-05.html","label":"psirt@adobe.com"},{"url":"http://www.osvdb.org/62292","label":"psirt@adobe.com"},{"url":"http://www.securityfocus.com/bid/38197","label":"psirt@adobe.com"},{"url":"https://www.exploit-db.com/exploits/41855/","label":"psirt@adobe.com"},{"url":"http://secunia.com/advisories/38543","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://securitytracker.com/id?1023584","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.adobe.com/support/security/bulletins/apsb10-05.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.osvdb.org/62292","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/38197","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/41855/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","kev","in-the-wild","exploit-available"],"epss":0.90012,"epssPercentile":0.99792,"kev":true,"kevDateAdded":"2022-03-07","kevDueDate":"2022-09-07","kevRansomware":true,"exploited":true,"exploitAvailable":true,"ingestedAt":"2026-08-01T06:11:30.660Z","exploits":{"exploitdb":true,"metasploit":["auxiliary/scanner/http/adobe_xml_inject"],"checkedAt":"2026-09-21T15:23:32.086Z"},"slug":"CVE-2009-3960","body":"## Overview\n\nUnspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.\n\n## Affected\n\n- `blazeds <= 3.2`\n- `coldfusion = 7.0.2`\n- `coldfusion = 8.0`\n- `coldfusion = 8.0.1`\n- `coldfusion = 9.0`\n- `flex_data_services = 2.0.1`\n- `livecycle = 8.0.1`\n- `livecycle = 8.2.1`\n- `livecycle = 9.0`\n- `livecycle_data_services = 2.5.1`\n- `livecycle_data_services = 2.6.1`\n- `livecycle_data_services = 3.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":84,"depthScoreParts":{"impact":35.8,"likelihood":18,"exploitation":25,"ransomware":5},"changes":[]}