Adobe ColdFusion HTTP Response Splitting (APSB12-15)

medium Nessus Plugin ID 59715

Synopsis

An application hosted on the remote web server is affected by an HTTP response splitting vulnerability.

Description

The version of Adobe ColdFusion running on the remote host is affected by an HTTP response splitting vulnerability.

The coldfusion.filter.ComponentFilter class does not properly sanitize input used in the Location header of an HTTP response. A remote attacker can exploit this by tricking a user into making a malicious request, resulting in the injection of HTTP headers, modification of the HTTP response body, or splitting the HTTP response into multiple responses.

Solution

Apply the hotfixes referenced in Adobe advisory APSB12-15.

See Also

https://www.adobe.com/support/security/bulletins/apsb12-15.html

http://www.nessus.org/u?b863d2a9

Plugin Details

Severity: Medium

ID: 59715

File Name: coldfusion_apsb12-15.nasl

Version: 1.17

Type: remote

Family: CGI abuses

Published: 6/26/2012

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 2.7

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: cpe:/a:adobe:coldfusion

Required KB Items: installed_sw/ColdFusion

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 6/12/2012

Vulnerability Publication Date: 6/12/2012

Reference Information

CVE: CVE-2012-2041

BID: 53941

CWE: 20, 442, 629, 711, 712, 722, 725, 74, 750, 751, 79, 800, 801, 809, 811, 864, 900, 928, 931, 990