PT-2016-2687 · Adobe · Coldfusion

Dawid Golunski · Publicado 2016-09-01 · Atualizado 2020-09-04 · CVE-2016-4264

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 10 through 10 before Update 21 Adobe ColdFusion versions 11 through 11 before Update 10

Description The issue is related to an XML External Entity (XXE) problem in the Office Open XML (OOXML) feature, allowing remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference.

Recommendations For Adobe ColdFusion 10, apply Update 21 to resolve the issue. For Adobe ColdFusion 11, apply Update 10 to resolve the issue. As a temporary workaround, consider restricting the use of the OOXML feature until a patch is available.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2016-02079

CVE-2016-4264

Produtos afetados

Coldfusion

Referências · 9

• 🔥 http://legalhackers.com/advisories/Adobe-ColdFusion-11-XXE-Exploit-CVE-2016-4264.txt · Exploit
• 🔥 https://exploit-db.com/exploits/40346 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-4264 · Nota de Segurança
• https://helpx.adobe.com/security/products/coldfusion/apsb16-30.html · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-02079 · Nota de Segurança
• http://securityfocus.com/bid/92684 · Nota
• http://securitytracker.com/id/1036708 · Nota
• http://securityfocus.com/archive/1/539374/100/0/threaded · Nota
• https://osv.dev/vulnerability/CVE-2016-4264 · Aviso do Fabricante