Adobe ColdFusion 'probe.cfm' Cross Site Scripting Vulnerability

Bugtraq ID:	49220
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 18 2011 12:00AM
Updated:	Aug 18 2011 12:00AM
Credit:	G.R0b1n
Vulnerable:	Adobe ColdFusion 0
Not Vulnerable:

Adobe ColdFusion 'probe.cfm' Cross Site Scripting Vulnerability

Adobe ColdFusion is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker could exploit this vulnerability to execute arbitrary script code in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Adobe ColdFusion 'probe.cfm' Cross Site Scripting Vulnerability

To exploit this issue, an attacker must entice a victim into following a malicious URI.

The following example URI is available:

• /data/vulnerabilities/exploits/49220.txt

Adobe ColdFusion 'probe.cfm' Cross Site Scripting Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Adobe ColdFusion 'probe.cfm' Cross Site Scripting Vulnerability

References:

• Adobe ColdFusion Homepage (Adobe)
  
• ColdFusion Local Parameter Xss Exploit (Focusecurity.org)