CVE-2009-3960
Adobe BlazeDS Information Disclosure Vulnerability
Description
CVE-2009-3960 is a medium-severity information disclosure vulnerability affecting Adobe BlazeDS. Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 88.74% (99.5th percentile), this vulnerability has a notable probability of exploitation. This vulnerability is known to be used in ransomware campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | blazeds | <= 3.2 |
| adobe | coldfusion | 7.0.2; 8.0; 8.0.1; 9.0 |
| adobe | flex data services | 2.0.1 |
| adobe | livecycle | 8.0.1; 8.2.1; 9.0 |
| adobe | livecycle data services | 2.5.1; 2.6.1; 3.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
- http://secunia.com/advisories/38543(Broken Link)
- http://securitytracker.com/id?1023584(Broken Link, Third Party Advisory, VDB Entry)
- http://www.adobe.com/support/security/bulletins/apsb10-05.html(Not Applicable, Vendor Advisory)
- http://www.osvdb.org/62292(Broken Link)
- http://www.securityfocus.com/bid/38197(Broken Link, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/41855/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960(US Government Resource)
Weakness Type
Unspecified Weakness
No specific CWE has been assigned to this vulnerability. The underlying weakness type is not publicly categorized, but the vulnerability's impact is well-documented through its inclusion in the CISA KEV catalog.
Impact Analysis
CVE-2009-3960 carries a CVSS 3.1 score of 6.5 (MEDIUM), indicating a moderate-severity threat. The vulnerability is exploitable over the network with low attack complexity and requires no authentication, though user interaction is needed. Successful exploitation can severely compromise data confidentiality. Organizations running affected BlazeDS deployments face significant operational risk if this vulnerability remains unpatched.
Exploit Maturity
CVE-2009-3960 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 88.74% (99.5th percentile) reflects an exceptionally high probability of exploitation. Public exploit code is available, which lowers the barrier for attackers and increases the urgency of remediation. This vulnerability has been associated with ransomware campaigns, underscoring the financial and operational risks of delayed patching.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions.
- Verify that all instances of affected products (adobe blazeds <= 3.2; adobe coldfusion 7.0.2; 8.0; 8.0.1; 9.0; adobe flex data services 2.0.1) have been updated to patched versions.
- If immediate patching is not possible, restrict network access to affected systems using firewall rules and network segmentation to limit exposure.
- Monitor systems for indicators of compromise, including unusual process activity, unexpected network connections, and unauthorized configuration changes.
- Review security logs and conduct threat hunting to determine if the vulnerability was exploited prior to patching.
Technical Details
CVE-2009-3960 affects Adobe BlazeDS. Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure. The attack vector is network-based, meaning an attacker can exploit this vulnerability remotely without physical access to the target system. The CVSS score of 6.5 reflects a moderate vulnerability, but its inclusion in the KEV catalog confirms real-world exploitation risk.
Frequently Asked Questions
Is CVE-2009-3960 being actively exploited?
Yes. CVE-2009-3960 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 88.74% (99.5th percentile) further indicates a very high exploitation probability. This vulnerability is also known to be used in ransomware campaigns.
What products are affected by CVE-2009-3960?
CVE-2009-3960 affects Adobe BlazeDS. Specifically affected products include: adobe blazeds (<= 3.2), adobe coldfusion (7.0.2; 8.0; 8.0.1; 9.0), adobe flex data services (2.0.1), adobe livecycle (8.0.1; 8.2.1; 9.0), adobe livecycle data services (2.5.1; 2.6.1; 3.0).
How do I fix CVE-2009-3960?
Apply updates per vendor instructions. Ensure all affected systems are updated to the latest patched versions. If patching is not immediately possible, implement network-level mitigations to limit exposure.
How severe is CVE-2009-3960?
CVE-2009-3960 has a CVSS 3.1 score of 6.5 (MEDIUM). While rated as medium severity, its presence in the KEV catalog confirms it is being actively exploited and should be remediated promptly.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.