Detections
Analytics
Adobe ColdFusion login.cfm Query String XSS (APSB11-04)
medium Nessus Plugin ID 51955
Language:
Synopsis
A web application on the remote host has is affected by a cross-site scripting vulnerability.Description
The version of Adobe ColdFusion running on the remote host has is affected by a cross-site scripting vulnerability in the administrative web interface. Input to the query string of 'administrator/login.cfm' is not properly sanitized before being returned in an HTML response.A remote attacker can exploit this by tricking a user into making a specially crafted request, resulting in the execution of arbitrary script code.
This version of ColdFusion likely has several other vulnerabilities, although Nessus has not checked for those issues.
Solution
Apply the hotfix referenced in Adobe's advisory.See Also
https://www.adobe.com/support/security/bulletins/apsb11-04.html
Plugin Details
Severity: Medium
ID: 51955
File Name: coldfusion_login_querystring_xss.nasl
Version: 1.16
Type: remote
Family: CGI abuses : XSS
Published: 2/11/2011
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.0
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:adobe:coldfusion
Required KB Items: installed_sw/ColdFusion
Exploit Ease: No exploit is required
Exploited by Nessus: true
Patch Publication Date: 2/8/2011
Vulnerability Publication Date: 2/8/2011
Reference Information
CVE: CVE-2011-0580
BID: 46273