PT-2007-1188 · Adobe · Coldfusion Mx 7

Published 2007-02-14 · Updated 2011-03-08 · CVE-2006-5859

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Adobe ColdFusion MX 7 versions 7.0 through 7.0.1

Description: A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary HTML and web script via unknown vectors, possibly related to files such as Linkdirect.cfm, Topnav.cfm, and Welcomedoc.cfm, when Global Script Protection is not enabled.

Recommendations: For Adobe ColdFusion MX 7 versions 7.0 through 7.0.1, enable Global Script Protection to mitigate the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2006-5859

Affected Products

Coldfusion Mx 7

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2006-5859 · Security Note
• http://secunia.com/advisories/24115 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5859 · Note
• http://securityfocus.com/bid/22544 · Note
• http://osvdb.org/32121 · Note
• http://securitytracker.com/id?1017644 · Note
• http://adobe.com/support/security/bulletins/apsb07-03.html · Note
• http://vupen.com/english/advisories/2007/0592 · Note