title: ColdFusion Improper neutralization of web input during page generation could lead to arbitrary JavaScript execution in the browser
description: Adobe Coldfusion versions 2016 (update 16 and earlier), 2018 (update 10 and earlier) and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code in context of the current user. Exploitation of this issue requires user interaction.
problem types: Cross-site Scripting (XSS) (CWE-79)
affected:
{
product: ColdFusion
vendor: Adobe
versions:
lessThanOrEqual: 2016.16, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: 2018.10, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: 2021.0.0.323925, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: None, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.0
]