CVE-2009-3960

Katalog CVE

CVSS 6.5 · Medium KEV · sudah dieksploitasi Dipakai ransomware EPSS 90,1%

Kerentanan pada adobe blazeds, adobe coldfusion +3 lainnya. Skor CVSS 3.1 6.5 (Medium) menurut NVD. Masuk katalog KEV CISA pada 7 Maret 2022, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.

Rincian

Terbit di NVD

15 Februari 2010

Terakhir diubah

6 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

EPSS (30 hari)

90,1% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Adobe BlazeDS Information Disclosure Vulnerability

Masuk KEV

7 Maret 2022

Tenggat CISA

7 September 2022 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.adobe.com/support/security/bulletins/apsb10-05.html not applicable · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960 pemerintah AS
• http://securitytracker.com/id?1023584 broken link · advisory pihak ketiga · vdb entry
• http://www.securityfocus.com/bid/38197 broken link · advisory pihak ketiga · vdb entry
• https://www.exploit-db.com/exploits/41855/ exploit · advisory pihak ketiga · vdb entry
• http://secunia.com/advisories/38543 broken link
• http://www.osvdb.org/62292 broken link