{"id":"CVE-2009-3960","kind":"vulnerability","aliases":["CVE-2009-3960"],"related":[],"title":"Adobe BlazeDS: Adobe BlazeDS Information Disclosure Vulnerability","description":"Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.","summary":"Adobe BlazeDS, a Java remote-messaging library used by LifeCycle and ColdFusion, has an information disclosure flaw. CISA lists it as actively exploited, and ransomware use is tagged in the source data.","severity":"medium","cvss":6.5,"epss":0.90118,"exploited":true,"exploited_at":"2022-03-07T00:00:00+00:00","products":[{"name":"Adobe BlazeDS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe-blazeds","coldfusion","exploited","java","lifecycle","package","ransomware"],"not_affected_if":["no-blazeds-installed"],"how_to_check":null,"fix":"Apply the updates per the vendor instructions (CISA KEV required action); the fixed version is not stated in the sources.","status":"open","published_at":"2010-02-15T18:30:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:23:55+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-23T21:23:55Z","model":"claude-haiku-5-5","output":{"fix":"Apply the updates per the vendor instructions (CISA KEV required action); the fixed version is not stated in the sources.","reach":"unknown","impact":"medium","summary":"Adobe BlazeDS, a Java remote-messaging library used by LifeCycle and ColdFusion, has an information disclosure flaw. CISA lists it as actively exploited, and ransomware use is tagged in the source data.","category":"package","who_cares":["adobe-blazeds","coldfusion","lifecycle","java"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Find the affected and fixed BlazeDS versions and the exact disclosure scope in the Adobe advisory; check the CISA KEV entry and the EPSS data linked in sources.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-blazeds-installed"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000461,"input_tokens":2837,"output_tokens":354,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2009':9A,12A '-3960':10A,13A '2.0.1':83C '2.5.1':76C '2.6.1':77C '3.0':79C '3.2':62C '7.0.2':86C '8.0':87C '8.0.1':69C,88C '8.2.1':70C '9.0':72C,90C 'activ':47B 'adob':1A,3A,17B,25B 'adobe':14A 'adobe-blaz':16B 'allow':91C 'associ':102C 'attack':93C 'blaze':2A,4A,18B,26B,61C 'blazeds':15A 'cisa':43B 'coldfus':19B,37B,85C 'cve':8A,11A 'data':57B,74C,81C 'disclosur':6A,41B 'document':117C 'earlier':64C 'entiti':113C 'exploit':20B,48B 'extern':112C 'flaw':42B 'flex':80C 'inform':5A,40B,97C 'inject':109C 'java':21B,28B 'librari':32B 'lifecycl':22B,35B 'list':44B 'livecycl':68C,73C 'messag':31B 'obtain':95C 'packag':23B 'ransomwar':24B,50B 'refer':114C 'relat':107C 'remot':30B,92C 'remote-messag':29B 'request':105C 'sensit':96C 'servic':75C,82C 'sourc':56B 'tag':53B,110C 'unspecifi':58C 'use':33B,51B,66C 'vector':99C 'via':98C 'vulner':7A,59C 'xml':116C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2010-02-15T18:30:00+00:00","kev":{"dateAdded":"2022-03-07","dueDate":"2022-09-07","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2009-3960","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-3960","severity":null,"published_at":"2022-03-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:17+00:00","note":null},{"source":"epss","external_id":"CVE-2009-3960","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-3960","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2009-3960","url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3960","severity":null,"published_at":"2010-02-15T18:30:00+00:00","modified_at":"2026-08-06T05:16:33+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}