CVE-2009-3467: XSS
Published May 13, 2010
·Updated
Cross-site scripting (XSS) vulnerability in an unspecified method in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Affected Software
11 affected components
Adobe ColdFusion<=9.0
Adobe ColdFusion=4.5
Adobe ColdFusion=5.0
Adobe ColdFusion=6.0
Adobe ColdFusion=6.1
Adobe ColdFusion=7.0
Adobe ColdFusion=7.0.1
Adobe ColdFusion=7.0.2
Adobe ColdFusion=7.2-unknown
Adobe ColdFusion=8.0
Adobe ColdFusion=8.0.1
Remediation
Patch Available
Event History
May 13, 2010
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Data Sourced
via NVD·05:30 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2009-3467?
CVE-2009-3467 is considered a medium severity vulnerability due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2009-3467?
To fix CVE-2009-3467, upgrade to a patched version of Adobe ColdFusion that addresses this XSS vulnerability.
3
What versions of Adobe ColdFusion are affected by CVE-2009-3467?
CVE-2009-3467 affects Adobe ColdFusion versions 5.0 through 9.0, including 8.0 and 8.0.1.
4
What types of attacks are possible due to CVE-2009-3467?
CVE-2009-3467 allows remote attackers to inject arbitrary web scripts or HTML into vulnerable applications.
5
Is there a workaround for CVE-2009-3467 if I cannot upgrade?
While the best option is to upgrade, implementing input validation and encoding can help mitigate the risks associated with CVE-2009-3467.