Actively exploited in the wild
Adobe BlazeDS Information Disclosure Vulnerability
Adobe - BlazeDS · Listed in the CISA KEV since 2022-03-07. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2009-3960
MediumCVSS 6.5KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
An unspecified vulnerability in BlazeDS 3.2 and earlier, used in LiveCycle, LiveCycle Data Services, Flex Data Services, and ColdFusion, allows remote attackers to obtain sensitive information via injected tags and external entity references in XML documents.
Risk Assessment
An attacker can leak sensitive data, such as configuration or user data, from the application server.
Recommendation
Update to the latest available version of BlazeDS or apply the relevant security patches from Adobe.
Original NVD description (English source)
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.