PT-2016-2687 · Adobe · Coldfusion

Dawid Golunski · Published 2016-09-01 · Updated 2020-09-04 · CVE-2016-4264

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 10 through 10 before Update 21 Adobe ColdFusion versions 11 through 11 before Update 10

Description The issue is related to an XML External Entity (XXE) problem in the Office Open XML (OOXML) feature, allowing remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference.

Recommendations For Adobe ColdFusion 10, apply Update 21 to resolve the issue. For Adobe ColdFusion 11, apply Update 10 to resolve the issue. As a temporary workaround, consider restricting the use of the OOXML feature until a patch is available.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2016-02079

CVE-2016-4264

Affected Products

Coldfusion

References · 9

• 🔥 http://legalhackers.com/advisories/Adobe-ColdFusion-11-XXE-Exploit-CVE-2016-4264.txt · Exploit
• 🔥 https://exploit-db.com/exploits/40346 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-4264 · Security Note
• https://helpx.adobe.com/security/products/coldfusion/apsb16-30.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-02079 · Security Note
• https://osv.dev/vulnerability/CVE-2016-4264 · Vendor Advisory
• http://securityfocus.com/bid/92684 · Note
• http://securitytracker.com/id/1036708 · Note
• http://securityfocus.com/archive/1/539374/100/0/threaded · Note