CVE-2022-28818

Published: May 12, 2022Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

ColdFusion versions CF2021U3 (and earlier) and CF2018U13 are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

Affected (19)

Products: Adobe: Coldfusion

Adobe

1 product

Coldfusion

Configuration A

19 vulnerable

Vulnerable Software	Affected Versions
Adobe Coldfusion	Before 2018
Adobe Coldfusion	Version 2018
Adobe Coldfusion	Version 2018 update10
Adobe Coldfusion	Version 2018 update11
Adobe Coldfusion	Version 2018 update12
Adobe Coldfusion	Version 2018 update13
Adobe Coldfusion	Version 2018 update1
Adobe Coldfusion	Version 2018 update2
Adobe Coldfusion	Version 2018 update3
Adobe Coldfusion	Version 2018 update4
Adobe Coldfusion	Version 2018 update5
Adobe Coldfusion	Version 2018 update6
Adobe Coldfusion	Version 2018 update7
Adobe Coldfusion	Version 2018 update8
Adobe Coldfusion	Version 2018 update9
Adobe Coldfusion	Version 2021
Adobe Coldfusion	Version 2021 update1
Adobe Coldfusion	Version 2021 update2
Adobe Coldfusion	Version 2021 update3

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://helpx.adobe.com/security/products/coldfusion/apsb22-22.html

Source: psirt@adobe.com

Vendor Advisory

https://helpx.adobe.com/security/products/coldfusion/apsb22-22.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.