6.5Mittel
KEV
In Ransomware genutzt
CVE-2009-3960Adobe BlazeDS Information Disclosure Vulnerability
Bekannt ausgenutzt — Adobe BlazeDS Information Disclosure Vulnerability
CISA hat am 07.03.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 07.09.2022.
Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2009-3960
Beschreibung
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| adobe | blazeds | ≤ 3.2 | |
| adobe | coldfusion | 7.0.2 | |
| adobe | flex data services | 2.0.1 | |
| adobe | livecycle | 8.0.1 | |
| adobe | livecycle data services | 2.5.1 |
Referenzen und Patches
- 38197 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 1023584 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 62292 vdb-entryBroken Link
- 38543 third-party-advisoryBroken Link
- 41855 exploitExploitThird Party AdvisoryVDB Entry
- http://www.adobe.com/support/security/bulletins/apsb10-05.html Not ApplicableVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960 US Government Resource
CPE-Treffer (NVD) (12)
cpe:2.3:a:adobe:blazeds:*:*:*:*:*:*:*:*≤ 3.2cpe:2.3:a:adobe:coldfusion:7.0.2:*:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:8.0:*:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:8.0.1:*:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:9.0:*:*:*:*:*:*:*cpe:2.3:a:adobe:flex_data_services:2.0.1:*:*:*:*:*:*:*cpe:2.3:a:adobe:livecycle:8.0.1:*:*:*:*:*:*:*cpe:2.3:a:adobe:livecycle:8.2.1:*:*:*:*:*:*:*cpe:2.3:a:adobe:livecycle:9.0:*:*:*:*:*:*:*cpe:2.3:a:adobe:livecycle_data_services:2.5.1:*:*:*:*:*:*:*cpe:2.3:a:adobe:livecycle_data_services:2.6.1:*:*:*:*:*:*:*cpe:2.3:a:adobe:livecycle_data_services:3.0:*:*:*:*:*:*:*