CVE-2011-0734: XSS
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via an id parameter containing a JavaScript onLoad event handler for a BODY element, related to a "tag body" attack. NOTE: this was originally reported as affecting 9.0.1 CHF1 and earlier.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0734?
CVE-2011-0734 has a medium severity level due to its potential for cross-site scripting attacks.
How do I fix CVE-2011-0734?
To fix CVE-2011-0734, upgrade to Adobe ColdFusion 9.0.1 or later versions.
What are the potential impacts of CVE-2011-0734?
The impact of CVE-2011-0734 includes unauthorized access to user data and possible redirection to malicious sites.
Which versions of Adobe ColdFusion are affected by CVE-2011-0734?
CVE-2011-0734 affects Adobe ColdFusion versions 4.5 through 9.0 without the CHF1 update.
Can CVE-2011-0734 be exploited remotely?
Yes, CVE-2011-0734 can be exploited remotely by injecting malicious scripts through the id parameter.