CVE-2005-2480: XSS
Cross-site scripting (XSS) vulnerability in ColdFusion Fusebox 4.1.0 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter, which is not quoted in an error page, as demonstrated using index.cfm.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2005-2480?
CVE-2005-2480 is classified as a high severity vulnerability due to its potential for remote code execution via XSS attacks.
How do I fix CVE-2005-2480?
To mitigate CVE-2005-2480, users should upgrade to a newer, patched version of ColdFusion Fusebox that addresses the XSS vulnerability.
What software is affected by CVE-2005-2480?
CVE-2005-2480 specifically affects ColdFusion Fusebox version 4.1.0.
How does CVE-2005-2480 allow attacks?
CVE-2005-2480 allows attackers to inject arbitrary web scripts or HTML through the unquoted fuseaction parameter in error pages.
Can CVE-2005-2480 lead to data theft?
Yes, CVE-2005-2480 can lead to data theft as an attacker can exploit the XSS vulnerability to execute scripts in a user's session.