CVE-2009-3960
published 2010-02-15CVE-2009-3960: Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data…
PriorityP185medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2022-09-07
Exploited in the wild
EPSS
90.01%
99.8th percentile
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | blazeds | <= 3.2 | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | coldfusion | — | — |
| adobe | flex_data_services | — | — |
| adobe | livecycle | — | — |
| adobe | livecycle | — | — |
| adobe | livecycle | — | — |
| adobe | livecycle_data_services | — | — |
| adobe | livecycle_data_services | — | — |
| adobe | livecycle_data_services | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect XXE exploitation attempts by inspecting POST requests to BlazeDS/ColdFusion AMF endpoints (/messagebroker/http, /messagebroker/httpsecure, /flex2gateway/http, /flex2gateway/httpsecure) with Content-Type: application/x-amf containing XML DOCTYPE declarations with SYSTEM entity references. ↗
- →Flag HTTP responses from AMF endpoints that contain file content such as /etc/passwd lines (e.g. 'root:x:0:0:root:/root:/bin/bash'), indicating successful local file disclosure via XXE. ↗
- →The vulnerable classes are mx.messaging.channels.HTTPChannel and mx.messaging.channels.SecureHTTPChannel inside flex-messaging-common.jar; presence of unpatched versions of this JAR on a server indicates exposure. ↗
- ·The HTTPChannel endpoint paths (/messagebroker/http, /flex2gateway/http, etc.) are defaults and may be remapped per application deployment; detection rules must account for non-default endpoint configurations. ↗
- ·The exploit supports both HTTP and HTTPS protocols and both POST and GET methods, so detection should cover all four combinations across the known endpoint paths. ↗
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vulncheck6.5MEDIUM
cisa6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Adobe BlazeDS Information Disclosure Vulnerability
cisa·2022-03-07·CVSS 6.5
CVE-2009-3960 [MEDIUM] Adobe BlazeDS Information Disclosure Vulnerability
Vulnerability: Adobe BlazeDS Information Disclosure Vulnerability
Affected: Adobe BlazeDS
Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2009-3960
Remediation Due Date: 2022-09-07
GHSA
GHSA-5wf6-gpr3-53cq: Unspecified vulnerability in BlazeDS 3
ghsa_unreviewed·2022-05-02
CVE-2009-3960 [MEDIUM] GHSA-5wf6-gpr3-53cq: Unspecified vulnerability in BlazeDS 3
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
VulnCheck
Adobe BlazeDS Information Disclosure Vulnerability
vulncheck·2009·CVSS 6.5
CVE-2009-3960 [MEDIUM] Adobe BlazeDS Information Disclosure Vulnerability
Adobe BlazeDS Information Disclosure Vulnerability
Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.
Affected: Adobe BlazeDS
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://news.sophos.com/en-us/2021/09/21/cring-ransomware-group-exploits-ancient-coldfusion-server/; https://cybersecurityworks.com/howdymanage/uploads/file/csw_final_ransomware_index-update-q321-csw_.pdf; https://cybersecurityworks.com/howdymanage/uploads/file/ransomware-_-2022-spotlight-report_compressed.pdf; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://cybersecurityworks.com/howdymanage/uploads/file/RansomwareUpdate%20Re
No detection rules found.
Exploit-DB
Adobe (Multiple Products) - XML Injection File Content Disclosure
exploitdb·2017-04-07
CVE-2009-3960 Adobe (Multiple Products) - XML Injection File Content Disclosure
Adobe (Multiple Products) - XML Injection File Content Disclosure
---
#!/bin/bash
#
# Exploit Title: Adobe XML Injection file content disclosure
# Date: 07-04-2017
# Exploit Author: Thomas Sluyter
# Website: https://www.kilala.nl
# Vendor Homepage: http://www.adobe.com/support/security/bulletins/apsb10-05.html
# Version: Multiple Adobe products
# Tested on: Windows Server 2003, ColdFusion 8.0 Enterprise
# CVE : 2009-3960
#
# Shell script that let's you exploit a known XML injection vulnerability
# in a number of Adobe products, allowing you to read files that are otherwise
# inaccessible. In Metasploit, this is achieved with auxiliary:scanner:adobe_xml_inject
# This script is a Bash implementation of the PoC multiple/dos/11529.txt.
#
# According to the original Metasploit code, this atta
Exploit-DB
Adobe (Multiple Products) - XML External Entity / XML Injection
exploitdb·2010-02-22·CVSS 6.5
CVE-2009-3960 [MEDIUM] Adobe (Multiple Products) - XML External Entity / XML Injection
Adobe (Multiple Products) - XML External Entity / XML Injection
---
( , ) (,
. `.' ) ('. ',
). , ('. ( ) (
(_,) .`), ) _ _,
/ _____/ / _ \ ____ ____ _____
\____ \==/ /_\ \ _/ ___\/ _ \ / \
/ \/ | \\ \__( ) Y Y \
/______ /\___|__ / \___ >____/|__|_| /
\/ \/.-. \/ \/:wq
(x.0)
'=.|w|.='
_='`"``=.
presents..
Multiple Adobe Products
XML External Entity And XML Injection Vulnerabilities
CVE: CVE-2009-3960
Adobe PSIRT: APSB10-05 - http://www.adobe.com/support/security/bulletins/apsb10-05.html
Link: http://www.security-assessment.com/files/advisories/2010-02-22_Multiple_Adobe_Products-XML_External_Entity_and_XML_Injection.pdf
+-----------+
|Description|
+-----------+
Security-Assessment.com discovered that multiple Adobe
products with different Data Services versions are
vulnerable to XML E
Metasploit
Adobe XML External Entity Injection
metasploit
Adobe XML External Entity Injection
Adobe XML External Entity Injection
Multiple Adobe Products -- XML External Entity Injection. Affected Software: BlazeDS 3.2 and earlier versions, LiveCycle 9.0, 8.2.1, and 8.0.1, LiveCycle Data Services 3.0, 2.6.1, and 2.5.1, Flex Data Services 2.0.1, ColdFusion 9.0, 8.0.1, 8.0, and 7.0.2
Tenable
Cybersecurity Snapshot: Ghost Ransomware Group Targets Known Vulns, CISA Warns, While Report Finds Many Cyber Pros Want To Switch Jobs
blogs_tenable·2025-02-21
Cybersecurity Snapshot: Ghost Ransomware Group Targets Known Vulns, CISA Warns, While Report Finds Many Cyber Pros Want To Switch Jobs
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
CISA and FBI: Ghost ransomware breached orgs in 70 countries
blogs_bleepingcomputer·2025-02-19·CVSS 6.5
[MEDIUM] CISA and FBI: Ghost ransomware breached orgs in 70 countries
## CISA and FBI: Ghost ransomware breached orgs in 70 countries
## Sergiu Gatlan
CISA and the FBI said attackers deploying Ghost ransomware have breached victims from multiple industry sectors across over 70 countries, including critical infrastructure organizations.
Other industries impacted include healthcare, government, education, technology, manufacturing, and numerous small and medium-sized businesses.
"Beginning early 2021, Ghost actors began attacking victims whose internet facing services ran outdated versions of software and firmware," CISA, the FBI, and the Multi-State Information Sharing and Analysis Center (MS-ISAC) said in a joint advisory released on Wednesday.
"This indiscriminate targeting of networks containing vulnerabilities has led to the compromise of organizatio
http://secunia.com/advisories/38543http://securitytracker.com/id?1023584http://www.adobe.com/support/security/bulletins/apsb10-05.htmlhttp://www.osvdb.org/62292http://www.securityfocus.com/bid/38197https://www.exploit-db.com/exploits/41855/http://secunia.com/advisories/38543http://securitytracker.com/id?1023584http://www.adobe.com/support/security/bulletins/apsb10-05.htmlhttp://www.osvdb.org/62292http://www.securityfocus.com/bid/38197https://www.exploit-db.com/exploits/41855/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960
2010-02-15
Published
2022-03-07
Added to CISA KEV
Exploited in the wild