Vulnerability

CERT-In Vulnerability Note CIVN-2013-0205
Multiple Vulnerabilities in Adobe Cold Fusion

Original Issue Date:November 14, 2013

Severity Rating: HIGH

Systems Affected

ColdFusion 10, 9.0.2, 9.0.1 and 9.0 for Windows, Macintosh and Linux

Overview

Two vulnerabilities have been reported in Adobe ColdFusion, which could be exploited by remote attackers to conduct cross site scripting attacks or gain unauthorized access to files on a vulnerable system.

Description

1) The cross-site scripting vulnerability exist due to improper sanitization of user-supplied input to unspecified components in the CFDIE directory. An authenticated, remote attacker could exploit this vulnerability by convincing a user to follow a malicious link.

Successful exploitation of this vulnerability allows the attacker to include malicious script or HTML code in the users browser in the security context of the affected site.

2) The unauthorized access vulnerability is due to an unspecified error. An attacker could exploit the vulnerability to gain unauthorized access to read files on the server.

Solution

Apply appropriate updates as mentioned in APSB13-27.

Vendor Information

Adobe
https://www.adobe.com/support/security/bulletins/apsb13-27.html

References

Adobe
https://www.adobe.com/support/security/bulletins/apsb13-27.html

Cisco
http://tools.cisco.com/security/center/viewAlert.x?alertId=31735

Secunia
http://secunia.com/advisories/55624/

CVE Name
CVE-2013-5326
CVE-2013-5328

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India