43264

http://www.adobe.com/support/security/bulletins/apsb11-04.html

46273

1025036

ADV-2011-0334

adobe-coldfusion-multiple-xss(65277)

The version of Adobe ColdFusion running on the remote Windows host is affected by multiple vulnerabilities :

  - Multiple cross-site scripting vulnerabilities exist in     the ColdFusion administrator console. (CVE-2011-0580)

  - Multiple CRLF injection vulnerabilities in various tags     allow adding headers. (CVE-2011-0581)

  - An information disclosure vulnerability exists in the     ColdFusion administrator console. (CVE-2011-0582)

  - A cross-site scripting vulnerability exists with the     cfform tag. (CVE-2011-0583)

  - A session fixation vulnerability exists for ColdFusion     sessions. (CVE-2011-0584)

The version of Adobe ColdFusion running on the remote host has is affected by a cross-site scripting vulnerability in the administrative web interface. Input to the query string of 'administrator/login.cfm' is not properly sanitized before being returned in an HTML response.

A remote attacker can exploit this by tricking a user into making a specially crafted request, resulting in the execution of arbitrary script code.

This version of ColdFusion likely has several other vulnerabilities, although Nessus has not checked for those issues.

ID	Name	Product	Family	Severity
55553	Adobe ColdFusion Multiple Vulnerabilities (APSB11-04) (credentialed check)	Nessus	Windows	medium
51955	Adobe ColdFusion login.cfm Query String XSS (APSB11-04)	Nessus	CGI abuses : XSS	medium

CVE-2011-0580

medium

Tenable Plugins

medium

medium