Adobe ColdFusion is prone to an unspecified cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker could exploit this vulnerability to execute arbitrary script code in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
The following versions are affected:
ColdFusion 2018 Update 1 and prior versions.
ColdFusion 2016 Update 7 and prior versions.
ColdFusion 11 Update 15 and prior versions.
Information
Adobe ColdFusion 2016.0 Update 7
Adobe ColdFusion 2016.0 Update 6
Adobe ColdFusion 2016.0 Update 5
Adobe ColdFusion 2016.0 Update 4
Adobe ColdFusion 2016.0 Update 3
Adobe ColdFusion 2016.0 Update 2
Adobe ColdFusion 2016.0 Update 1
Adobe ColdFusion 2016.0
Adobe ColdFusion 11 Update 9
Adobe ColdFusion 11 Update 8
Adobe ColdFusion 11 Update 7
Adobe ColdFusion 11 Update 6
Adobe ColdFusion 11 Update 5
Adobe ColdFusion 11 Update 4
Adobe ColdFusion 11 Update 3
Adobe ColdFusion 11 Update 2
Adobe ColdFusion 11 Update 15
Adobe ColdFusion 11 Update 14
Adobe ColdFusion 11 Update 13
Adobe ColdFusion 11 Update 12
Adobe ColdFusion 11 Update 11
Adobe ColdFusion 11 Update 10
Adobe ColdFusion 11 Update 1
Adobe ColdFusion 11
Adobe ColdFusion 2016.0 Update 8
Adobe ColdFusion 11 Update 16
Exploit
To exploit this issue an attacker must entice a victim into following a malicious URI.
References:
- Adobe ColdFusion Homepage (Adobe)
- Adobe Homepage (Adobe)
- APSB19-10: Security updates available for ColdFusion (Adobe)