CVE-2022-28818: ColdFusion Reflected Cross-Site Scripting could lead to Arbitrary Code Execution
Published May 12, 2022
·Updated
ColdFusion versions CF2021U3 (and earlier) and CF2018U13 are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Affected Software
19 affected components
Adobe ColdFusion<2018
Adobe ColdFusion=2018
Adobe ColdFusion=2018-update1
Adobe ColdFusion=2018-update10
Adobe ColdFusion=2018-update11
Adobe ColdFusion=2018-update12
Adobe ColdFusion=2018-update13
Adobe ColdFusion=2018-update2
Adobe ColdFusion=2018-update3
Adobe ColdFusion=2018-update4
Adobe ColdFusion=2018-update5
Adobe ColdFusion=2018-update6
Adobe ColdFusion=2018-update7
Adobe ColdFusion=2018-update8
Adobe ColdFusion=2018-update9
Adobe ColdFusion=2021
Adobe ColdFusion=2021-update1
Adobe ColdFusion=2021-update2
Adobe ColdFusion=2021-update3
Event History
May 12, 2022
CVE Published
via MITRE·06:59 PM
Data Sourced
via MITRE·06:59 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-28818?
The severity of CVE-2022-28818 is medium with a CVSS score of 6.1.
2
Which versions of ColdFusion are affected by CVE-2022-28818?
ColdFusion versions CF2021U3 (and earlier) and CF2018U13 are affected by CVE-2022-28818.
3
What is the vulnerability type of CVE-2022-28818?
CVE-2022-28818 is a reflected Cross-Site Scripting (XSS) vulnerability.
4
How can an attacker exploit CVE-2022-28818?
An attacker can exploit CVE-2022-28818 by convincing a victim to visit a URL referencing a vulnerable page.
5
Where can I find more information about CVE-2022-28818?
You can find more information about CVE-2022-28818 in the Adobe Security Bulletin APSB22-22.