PT-2005-3385 · Adobe · Coldfusion Fusebox

N.N.P · Published 2005-08-05 · Updated 2017-07-11 · CVE-2005-2480

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ColdFusion Fusebox version 4.1.0

Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML via the fuseaction parameter in an error page, as demonstrated using index.cfm.

Recommendations For ColdFusion Fusebox version 4.1.0, consider quoting the fuseaction parameter in error pages to prevent injection of arbitrary web script or HTML. As a temporary workaround, restrict access to the index.cfm page until a proper fix is applied.

Exploit

Fix

Related Identifiers

CVE-2005-2480

Affected Products

Coldfusion Fusebox

References · 6

• 🔥 https://exploit-db.com/exploits/26065 · Exploit
• 🔥 http://securityfocus.com/bid/14460 · Exploit
• http://secunia.com/advisories/16320 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2480 · Security Note
• http://marc.info/?l=bugtraq&m=112309656102615&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21697 · Note