Cross-Site Scripting in Adobe ColdFusion by Adobe
CVE-2018-4940

6.1MEDIUM

Key Information:

Vendor
Adobe
Status
Adobe Coldfusion Coldfusion Update 5 And Earlier Versions, Coldfusion 11 Update 13 And Earlier Versions
Vendor
CVE Published:
19 May 2018

Summary

Adobe ColdFusion versions Update 5 and earlier, as well as ColdFusion 11 Update 13 and earlier, contain a vulnerability that enables Cross-Site Scripting (XSS) attacks. This security flaw can be exploited by malicious actors to potentially disclose sensitive information from affected systems. It is critical for users of the impacted versions to evaluate their environment and apply necessary patches to prevent exploitation.

Affected Version(s)

Adobe ColdFusion ColdFusion Update 5 and earlier , ColdFusion 11 Update 13 and earlier Adobe ColdFusion ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions

References

https://helpx.adobe.com/security/products/coldfusion/apsb...
x_refsource_MISC
http://www.securityfocus.com/bid/103718
vdb-entryx_refsource_BID

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.