CVE-2016-4264: XEE
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4264?
CVE-2016-4264 is considered a critical vulnerability as it allows remote attackers to read arbitrary files and send TCP requests.
How do I fix CVE-2016-4264?
To fix CVE-2016-4264, upgrade Adobe ColdFusion to version 10 Update 21 or 11 Update 10 or later.
What types of attacks can be performed using CVE-2016-4264?
CVE-2016-4264 allows attackers to exploit OOXML spreadsheets to read files and potentially access intranet resources.
Which versions of Adobe ColdFusion are affected by CVE-2016-4264?
CVE-2016-4264 affects Adobe ColdFusion versions 10 before Update 21 and 11 before Update 10.
Is CVE-2016-4264 related to XML parsing issues?
Yes, CVE-2016-4264 is related to XML external entity (XXE) vulnerabilities due to flawed parsing of OOXML formats.