CVE-2017-3008: XSS

Published Apr 27, 2017

Updated

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a reflected cross-site scripting vulnerability.

Affected Software

39 affected components

Adobe ColdFusion=10.0

Adobe ColdFusion=10.0-update1

Adobe ColdFusion=10.0-update10

Adobe ColdFusion=10.0-update11

Adobe ColdFusion=10.0-update12

Adobe ColdFusion=10.0-update13

Adobe ColdFusion=10.0-update14

Adobe ColdFusion=10.0-update15

Adobe ColdFusion=10.0-update16

Adobe ColdFusion=10.0-update17

Adobe ColdFusion=10.0-update18

Adobe ColdFusion=10.0-update19

Adobe ColdFusion=10.0-update2

Adobe ColdFusion=10.0-update20

Adobe ColdFusion=10.0-update21

Adobe ColdFusion=10.0-update22

Adobe ColdFusion=10.0-update3

Adobe ColdFusion=10.0-update4

Adobe ColdFusion=10.0-update5

Adobe ColdFusion=10.0-update6

Adobe ColdFusion=10.0-update7

Adobe ColdFusion=10.0-update8

Adobe ColdFusion=10.0-update9

Adobe ColdFusion=11.0

Adobe ColdFusion=11.0-update1

Adobe ColdFusion=11.0-update10

Adobe ColdFusion=11.0-update11

Adobe ColdFusion=11.0-update2

Adobe ColdFusion=11.0-update3

Adobe ColdFusion=11.0-update4

Adobe ColdFusion=11.0-update5

Adobe ColdFusion=11.0-update6

Adobe ColdFusion=11.0-update7

Adobe ColdFusion=11.0-update8

Adobe ColdFusion=11.0-update9

Adobe ColdFusion=2016

Adobe ColdFusion=2016-update1

Adobe ColdFusion=2016-update2

Adobe ColdFusion=2016-update3

Remediation

Patch Available

https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html

Event History

Apr 27, 2017

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-3008?

The severity of CVE-2017-3008 is rated as medium with a score of 6.1.

How do I fix CVE-2017-3008?

To fix CVE-2017-3008, update Adobe ColdFusion to version 2016 Update 4 or later, ColdFusion 11 Update 12 or later, or ColdFusion 10 Update 23 or later.

What type of vulnerability is CVE-2017-3008?

CVE-2017-3008 is a reflected cross-site scripting (XSS) vulnerability.

Which versions of Adobe ColdFusion are affected by CVE-2017-3008?

CVE-2017-3008 affects Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 Update 11 and earlier, and ColdFusion 10 Update 22 and earlier.

What is the impact of CVE-2017-3008 on Adobe ColdFusion?

The impact of CVE-2017-3008 can allow an attacker to execute scripts in the context of a user's session, potentially compromising user data.