CVE-2017-11285: XSS
Published Dec 1, 2017
·Updated
Adobe ColdFusion has a cross-site scripting (XSS) vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.
Affected Software
18 affected components
Adobe ColdFusion=11.0
Adobe ColdFusion=11.0-update1
Adobe ColdFusion=11.0-update10
Adobe ColdFusion=11.0-update11
Adobe ColdFusion=11.0-update12
Adobe ColdFusion=11.0-update2
Adobe ColdFusion=11.0-update3
Adobe ColdFusion=11.0-update4
Adobe ColdFusion=11.0-update5
Adobe ColdFusion=11.0-update6
Adobe ColdFusion=11.0-update7
Adobe ColdFusion=11.0-update8
Adobe ColdFusion=11.0-update9
Adobe ColdFusion=2016
Adobe ColdFusion=2016-update1
Adobe ColdFusion=2016-update2
Adobe ColdFusion=2016-update3
Adobe ColdFusion=2016-update4
Remediation
Event History
Dec 1, 2017
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-11285?
CVE-2017-11285 has been rated as a medium severity cross-site scripting vulnerability.
2
How do I fix CVE-2017-11285?
To fix CVE-2017-11285, upgrade to ColdFusion 2016 Update 5 or later, or ColdFusion 11 Update 13 or later.
3
Who is affected by CVE-2017-11285?
CVE-2017-11285 affects all versions of Adobe ColdFusion 2016 prior to Update 5 and ColdFusion 11 prior to Update 13.
4
What type of vulnerability is CVE-2017-11285?
CVE-2017-11285 is a cross-site scripting (XSS) vulnerability.
5
Can CVE-2017-11285 be exploited remotely?
Yes, CVE-2017-11285 can potentially be exploited remotely to execute malicious scripts in a user's browser.