CVE-2007-0817: XSS

Published Feb 7, 2007

Updated

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion web server allows remote attackers to inject arbitrary HTML or web script via the User-Agent HTTP header, which is not sanitized before being displayed in an error page.

Affected Software

3 affected components

Adobe ColdFusion=7.0.2

Adobe ColdFusion=6.1

Adobe ColdFusion=7.0.1

Event History

Feb 7, 2007

CVE Published

11:28 AM

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-0817?

CVE-2007-0817 is considered a medium severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2007-0817?

To fix CVE-2007-0817, update your Adobe ColdFusion installation to a patched version that sanitizes the User-Agent HTTP header.

Which versions of Adobe ColdFusion are affected by CVE-2007-0817?

CVE-2007-0817 affects Adobe ColdFusion versions 6.1, 7.0.1, and 7.0.2.

What is the nature of the vulnerability in CVE-2007-0817?

The vulnerability in CVE-2007-0817 allows remote attackers to inject arbitrary HTML or web scripts via inadequate input sanitization of the User-Agent header.

Who is at risk from CVE-2007-0817?

Web applications using vulnerable versions of Adobe ColdFusion are at risk, particularly those that expose error pages containing unsanitized User-Agent headers.