Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and…

published 2010-02-15 16 y ago modified 2026-08-06 3 mo ago also EUVD-2009-3931

cvss: 6.5; version 3.1, CNA
cisa kev: Exploited; added 2022-03-07, used in ransomware
epss: 90.1%; EPSS 90.1% chance of exploitation in 30 days, percentile 99.7%
public exploits: 3; Metasploit, Exploit-DB

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.

Patch / fix

cisa required action Apply updates per vendor instructions.

Timeline

2010-02-15 Published
2010-02-22 First public exploit (EDB-11529)
2022-03-07 Added to CISA KEV
2022-03-11 CISA SSVC: exploitation active
2022-09-07 CISA patch deadline

Known exploited

Added: 4 y ago (2022-03-07)
Patch by: 2022-09-07 (4 y ago)
Ransomware: Known to be used in ransomware campaigns
Required action: Apply updates per vendor instructions.
Vendor, product: Adobe, BlazeDS
CISA name: Adobe BlazeDS Information Disclosure Vulnerability

Ransomware

Groups reported to have exploited it in intrusions.

Ghost/Cring ransomware gang

reported by cisa.gov

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

T1190 Exploit Public-Facing Application exploitation
T1486 Data Encrypted for Impact primary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: partial
Assessed: 4 y ago (2022-03-11)

Exploit prediction

90.12% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit auxiliary/scanner/http/adobe_xml_inject Adobe XML External Entity Injection metasploit auxiliary, normal rank
EDB-41855 Adobe (Multiple Products) - XML Injection File Content Disclosure webapps, 2017-04-07
EDB-11529 Adobe (Multiple Products) - XML External Entity / XML Injection dos, 2010-02-22

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CNA	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:P/I:N/A:N

References

exploit-db.com /exploits/41855/
exploit, third-party-advisory, vdb-entry
adobe.com /support/security/bulletins/apsb10-05.html
not-applicable, vendor-advisory
securityfocus.com /bid/38197
vdb-entry, broken-link, third-party-advisory
securitytracker.com /id?1023584
vdb-entry, broken-link, third-party-advisory
osvdb.org /62292
vdb-entry, broken-link
secunia.com /advisories/38543
third-party-advisory, broken-link
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960
government-resource, us-government-resource

Sources

CVE List CVE-2009-3960
NVD CVE-2009-3960

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary