Detections
Analytics
Adobe ColdFusion Multiple Vulnerabilities (APSB14-23) (credentialed check)
medium Nessus Plugin ID 78480
Language:
Synopsis
A web-based application running on the remote Windows host is affected by multiple vulnerabilities.Description
The version of Adobe ColdFusion running on the remote Windows host is affected by the following vulnerabilities :- An unspecified cross-site request forgery vulnerability exists because ColdFusion does not properly sanitize user-supplied input. (CVE-2014-0570)
- An unspecified cross-site scripting vulnerability exists because ColdFusion does not properly sanitize user-supplied input. (CVE-2014-0571)
- ColdFusion is affected by a security permissions issue which can allow a local, unauthenticated user to bypass IP address access control restrictions.
(CVE-2014-0572)
Solution
Apply the relevant hotfixes referenced in Adobe advisory APSB14-23.See Also
https://helpx.adobe.com/security/products/coldfusion/apsb14-23.html
Plugin Details
Severity: Medium
ID: 78480
File Name: coldfusion_win_apsb14-23.nasl
Version: 1.11
Type: local
Agent: windows
Family: Windows
Published: 10/15/2014
Updated: 11/15/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:adobe:coldfusion
Required KB Items: SMB/coldfusion/instance
Exploit Ease: No known exploits are available
Patch Publication Date: 10/14/2014
Vulnerability Publication Date: 10/14/2014