CVE-2009-3960

Опубликовано: 15 фев. 2010

Источник: nvd

CVSS3: 6.5

CVSS2: 4.3

EPSS Высокий

Описание

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.

Ссылки

http://secunia.com/advisories/38543
Broken Link
http://securitytracker.com/id?1023584
Broken Link
Third Party Advisory
VDB Entry
http://www.adobe.com/support/security/bulletins/apsb10-05.html
Not Applicable
Vendor Advisory
http://www.osvdb.org/62292
Broken Link
http://www.securityfocus.com/bid/38197
Broken Link
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/41855/
Exploit
Third Party Advisory
VDB Entry
http://secunia.com/advisories/38543
Broken Link
http://securitytracker.com/id?1023584
Broken Link
Third Party Advisory
VDB Entry
http://www.adobe.com/support/security/bulletins/apsb10-05.html
Not Applicable
Vendor Advisory
http://www.osvdb.org/62292
Broken Link
http://www.securityfocus.com/bid/38197
Broken Link
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/41855/
Exploit
Third Party Advisory
VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:adobe:blazeds:*:*:*:*:*:*:*:*

Версия до 3.2 (включая)

cpe:2.3:a:adobe:coldfusion:7.0.2:*:*:*:*:*:*:*

cpe:2.3:a:adobe:coldfusion:8.0:*:*:*:*:*:*:*

cpe:2.3:a:adobe:coldfusion:8.0.1:*:*:*:*:*:*:*

cpe:2.3:a:adobe:coldfusion:9.0:*:*:*:*:*:*:*

cpe:2.3:a:adobe:flex_data_services:2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:adobe:livecycle:8.0.1:*:*:*:*:*:*:*

cpe:2.3:a:adobe:livecycle:8.2.1:*:*:*:*:*:*:*

cpe:2.3:a:adobe:livecycle:9.0:*:*:*:*:*:*:*

cpe:2.3:a:adobe:livecycle_data_services:2.5.1:*:*:*:*:*:*:*

cpe:2.3:a:adobe:livecycle_data_services:2.6.1:*:*:*:*:*:*:*

cpe:2.3:a:adobe:livecycle_data_services:3.0:*:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.8874

Высокий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-5wf6-gpr3-53cq

CVSS3: 6.5

github

почти 4 года назад

BDU:2023-00588

CVSS3: 5.3

fstec

почти 16 лет назад

Уязвимость компонента BlazeDS программной платформы ColdFusion, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации