Adobe ColdFusion CVE-2017-3008 Unspecified Cross Site Scripting Vulnerability
BID:98002
Info
Adobe ColdFusion CVE-2017-3008 Unspecified Cross Site Scripting Vulnerability
| Bugtraq ID: | 98002 |
| Class: | Input Validation Error |
| CVE: |
CVE-2017-3008 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 25 2017 12:00AM |
| Updated: | May 02 2017 01:09AM |
| Credit: | Lion |
| Vulnerable: |
Adobe ColdFusion 2016.0 Update 3 Adobe ColdFusion 2016.0 Update 2 Adobe ColdFusion 2016.0 Update 1 Adobe ColdFusion 2016.0 Adobe ColdFusion 11 Update 9 Adobe ColdFusion 11 Update 8 Adobe ColdFusion 11 Update 7 Adobe ColdFusion 11 Update 6 Adobe ColdFusion 11 Update 5 Adobe ColdFusion 11 Update 4 Adobe ColdFusion 11 Update 3 Adobe ColdFusion 11 Update 2 Adobe ColdFusion 11 Update 11 Adobe ColdFusion 11 Update 10 Adobe ColdFusion 11 Update 1 Adobe ColdFusion 11 Adobe ColdFusion 10.0 Update 8 Adobe ColdFusion 10.0 Update 4 Adobe ColdFusion 10.0 Update 3 Adobe ColdFusion 10.0 Update 2 Adobe ColdFusion 10.0 Update 14 Adobe ColdFusion 10.0 Update 11 Adobe ColdFusion 10.0 Update 1 Adobe ColdFusion 10 Update 9 Adobe ColdFusion 10 Update 6 Adobe ColdFusion 10 Update 5 Adobe ColdFusion 10 Update 22 Adobe ColdFusion 10 Update 21 Adobe ColdFusion 10 Update 20 Adobe ColdFusion 10 Update 19 Adobe ColdFusion 10 Update 18 Adobe ColdFusion 10 Update 17 Adobe ColdFusion 10 Update 16 Adobe ColdFusion 10 Update 15 Adobe ColdFusion 10 Update 14 Adobe ColdFusion 10 Update 13 Adobe ColdFusion 10 Update 12 Adobe ColdFusion 10 Update 11 Adobe ColdFusion 10 Update 10 Adobe ColdFusion 10 Update 1 Adobe ColdFusion 10 |
| Not Vulnerable: |
Adobe ColdFusion 2016.0 Update 4 Adobe ColdFusion 11 Update 12 Adobe ColdFusion 10 Update 23 |
Discussion
Adobe ColdFusion CVE-2017-3008 Unspecified Cross Site Scripting Vulnerability
Adobe ColdFusion is prone to an unspecified cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker could exploit this vulnerability to execute arbitrary script code in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
The following versions are vulnerable:
ColdFusion (2016 release) Update 3 and prior
ColdFusion 11 Update 11 and prior
ColdFusion 10 Update 22 and prior
Adobe ColdFusion is prone to an unspecified cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker could exploit this vulnerability to execute arbitrary script code in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
The following versions are vulnerable:
ColdFusion (2016 release) Update 3 and prior
ColdFusion 11 Update 11 and prior
ColdFusion 10 Update 22 and prior
Exploit / POC
Adobe ColdFusion CVE-2017-3008 Unspecified Cross Site Scripting Vulnerability
To exploit this issue an attacker must entice a victim into following a malicious URI.
To exploit this issue an attacker must entice a victim into following a malicious URI.
Solution / Fix
Adobe ColdFusion CVE-2017-3008 Unspecified Cross Site Scripting Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Adobe ColdFusion CVE-2017-3008 Unspecified Cross Site Scripting Vulnerability
References:
References: