CVE-2023-44352

Published: Nov 17, 2023Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

Affected (19)

Products: Adobe: Coldfusion

Adobe

1 product

Coldfusion

Configuration A

19 vulnerable

Vulnerable Software	Affected Versions
Adobe Coldfusion	Before 2021
Adobe Coldfusion	Version 2021
Adobe Coldfusion	Version 2021 update10
Adobe Coldfusion	Version 2021 update11
Adobe Coldfusion	Version 2021 update1
Adobe Coldfusion	Version 2021 update2
Adobe Coldfusion	Version 2021 update3
Adobe Coldfusion	Version 2021 update4
Adobe Coldfusion	Version 2021 update5
Adobe Coldfusion	Version 2021 update6
Adobe Coldfusion	Version 2021 update7
Adobe Coldfusion	Version 2021 update8
Adobe Coldfusion	Version 2021 update9
Adobe Coldfusion	Version 2023
Adobe Coldfusion	Version 2023 update1
Adobe Coldfusion	Version 2023 update2
Adobe Coldfusion	Version 2023 update3
Adobe Coldfusion	Version 2023 update4
Adobe Coldfusion	Version 2023 update5

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html

Source: psirt@adobe.com

Release NotesVendor Advisory

https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.