header-logo
Suggest Exploit
vendor:
ColdFusion MX
by:
SecurityFocus
7.5
CVSS
HIGH
Cross Site Scripting
79
CWE
Product Name: ColdFusion MX
Affected Version From: ColdFusion MX
Affected Version To: ColdFusion MX
Patch Exists: YES
Related CWE: N/A
CPE: a:macromedia:coldfusion_mx
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2002

ColdFusion MX Cross Site Scripting Vulnerability

ColdFusion MX is prone to cross site scripting attacks. Attacker-supplied script code may be included in a malicious missing template URI generated by the default Missing Template handler of ColdFusion. The attacker-supplied script code will be executed in the browser of a web user who visits this link, in the security context of the host running ColdFusion.

Mitigation:

Ensure that all user-supplied input is properly validated and filtered before being used in the application.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/5011/info

ColdFusion MX is prone to cross site scripting attacks.

Attacker-supplied script code may be included in a malicious missing template URI generated by the default Missing Template handler of ColdFusion. The attacker-supplied script code will be executed in the browser of a web user who visits this link, in the security context of the host running ColdFusion. 

http://CF_MX_SERVER/<script>alert(document.cookie)</script>.cfm

Navigation

Suggest Exploit

Services By CQR