{"schemaVersion":3,"id":"CVE-2009-3960","aliases":[],"status":"published","duplicateOf":null,"title":"Adobe BlazeDS Information Disclosure Vulnerability","description":"Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.","dates":{"published":"2010-02-15T18:00:00.000Z","modified":"2026-08-06T03:55:29.278Z","reserved":null,"kevAdded":["2022-03-07T00:00:00.000Z"],"kevDue":["2022-09-07T00:00:00.000Z"]},"cvss":{"headline":{"score":6.5,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.3,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.90118,"percentile":0.99798,"severity":"critical","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.10599999999999499,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.90012},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.90012,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.90012,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.90012,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.90012,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.90012,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.90012,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.90012,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.90012,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.90012,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.90012,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.90012,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.90118,"percentile":0.99798}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.90012,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.90012,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.90012,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.90012,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.90012,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.90118,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.90118,"percentile":0.99798}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-03-07T00:00:00.000Z","dueDate":"2022-09-07T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Adobe BlazeDS Information Disclosure Vulnerability","description":"Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2009-3960","label":"nvd.nist.gov/vuln/detail/CVE-2009-3960"}],"vendor":"Adobe","product":"BlazeDS","ransomware":true,"ransomwareUse":"Known","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-03-07T00:00:00.000Z","dueDate":"2022-09-07T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Adobe BlazeDS Information Disclosure Vulnerability","description":"Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2009-3960","label":"nvd.nist.gov/vuln/detail/CVE-2009-3960"}],"vendor":"Adobe","product":"BlazeDS","ransomware":true,"ransomwareUse":"Known","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"known","sources":["cisa"]},"exploits":[{"id":"11529","name":"Adobe (Multiple Products) - XML External Entity / XML Injection","source":"exploit-database","url":"https://www.exploit-db.com/exploits/11529","maturity":"poc","reliabilityScore":0.8,"verified":true,"type":"dos","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"dos","platform":"multiple","file":"exploits/multiple/dos/11529.txt","codes":["CVE-2009-3960","OSVDB-62292"]},"metasploit":null},{"id":"41855","name":"Adobe (Multiple Products) - XML Injection File Content Disclosure","source":"exploit-database","url":"https://www.exploit-db.com/exploits/41855","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":null,"platforms":["xml"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"webapps","platform":"xml","file":"exploits/xml/webapps/41855.sh","codes":["CVE-2009-3960"]},"metasploit":null},{"id":"MSF_AUXILIARY_SCANNER_HTTP_ADOBE_XML_INJECT","name":"Adobe XML External Entity Injection","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/adobe_xml_inject.rb","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"auxiliary/scanner/http/adobe_xml_inject","rank":"300","rankName":"normal","postAuth":false,"check":false,"stability":[],"sideEffects":[],"reliability":[]}}],"exploitCount":3,"weaknesses":[],"affected":[{"vendor":"adobe","product":"blazeds","name":"BlazeDS","label":"blazeds","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 3.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 3.2","eol":null,"hubHref":"/vendor/adobe/blazeds"},{"vendor":"adobe","product":"coldfusion","name":"ColdFusion","label":"coldfusion","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"7.0.2","noFixRecorded":false,"fixedIn":null},{"text":"8.0","noFixRecorded":false,"fixedIn":null},{"text":"8.0.1","noFixRecorded":false,"fixedIn":null},{"text":"9.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.0.2 | 8.0 | 8.0.1 | 9.0","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"coldfusion","label":"Adobe ColdFusion","category":"server-app"}},"hubHref":"/vendor/adobe/coldfusion"},{"vendor":"adobe","product":"flex_data_services","name":"flex data services","label":"flex_data_services","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2.0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"2.0.1","eol":null,"hubHref":"/vendor/adobe/flex_data_services"},{"vendor":"adobe","product":"livecycle","name":"livecycle","label":"livecycle","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"8.0.1","noFixRecorded":false,"fixedIn":null},{"text":"8.2.1","noFixRecorded":false,"fixedIn":null},{"text":"9.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"8.0.1 | 8.2.1 | 9.0","eol":null,"hubHref":"/vendor/adobe/livecycle"},{"vendor":"adobe","product":"livecycle_data_services","name":"livecycle data services","label":"livecycle_data_services","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2.5.1","noFixRecorded":false,"fixedIn":null},{"text":"2.6.1","noFixRecorded":false,"fixedIn":null},{"text":"3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"2.5.1 | 2.6.1 | 3.0","eol":null,"hubHref":"/vendor/adobe/livecycle_data_services"}],"affectedCount":5,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securityfocus.com/bid/38197","label":"www.securityfocus.com/bid/38197","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory"]},{"url":"http://securitytracker.com/id?1023584","label":"securitytracker.com/id?1023584","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"http://www.osvdb.org/62292","label":"www.osvdb.org/62292","hostname":"www.osvdb.org","tags":["VDB Entry","X Refsource OSVDB","Broken Link"]},{"url":"http://secunia.com/advisories/38543","label":"secunia.com/advisories/38543","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"https://www.exploit-db.com/exploits/41855/","label":"www.exploit-db.com/exploits/41855/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb10-05.html","label":"www.adobe.com/support/security/bulletins/apsb10-05.html","hostname":"www.adobe.com","tags":["X Refsource CONFIRM","Not Applicable","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2010-02-15T18:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-03-07T00:00:00.000Z","label":"Added to CISA KEV","detail":"Adobe BlazeDS Information Disclosure Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-09-07T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2026-08-06T03:55:29.278Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T01:49:56.200Z","stale":false,"partial":false}}