Detections
Analytics
Adobe ColdFusion HTTP Response Splitting (APSB12-15) (credentialed check)
medium Nessus Plugin ID 74190
Language:
Synopsis
An application hosted on the remote web server is affected by an HTTP response splitting vulnerability.Description
The version of Adobe ColdFusion running on the remote host is affected by an HTTP response splitting vulnerability.The coldfusion.filter.ComponentFilter class does not properly sanitize input used in the Location header of an HTTP response. A remote attacker could exploit this by tricking a user into making a malicious request, resulting in the injection of HTTP headers, modification of the HTTP response body, or splitting the HTTP response into multiple responses.
Solution
Apply the hotfixes referenced in Adobe advisory APSB12-15.See Also
https://www.adobe.com/support/security/bulletins/apsb12-15.html
Plugin Details
Severity: Medium
ID: 74190
File Name: coldfusion_win_apsb12-15.nasl
Version: 1.5
Type: local
Agent: windows
Family: Windows
Published: 5/27/2014
Updated: 11/15/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 2.7
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:adobe:coldfusion
Required KB Items: SMB/coldfusion/instance
Exploit Ease: No known exploits are available
Patch Publication Date: 6/12/2012
Vulnerability Publication Date: 6/12/2012
Reference Information
CVE: CVE-2012-2041
BID: 53941