Adobe BlazeDS Information Disclosure Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 07/03/2022. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.
| Package | Affected versions | Patched versions |
|---|---|---|
| blazeds | ≤ 3.2 | |
| coldfusion | = 7.0.2= 8.0= 8.0.1= 9.0 | |
| flex data services | = 2.0.1 | |
| livecycle | = 8.0.1= 8.2.1= 9.0 | |
| livecycle data services | = 2.5.1= 2.6.1= 3.0 |
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free