Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not filtered in the resulting 404 error message.

Threat-Mapped Scoring

Score: 0.0

Priority: Unclassified

EPSS

Score: 0.16341
Percentile: 0.94554

CVSS Scoring

Mapped CWE(s)

• CWE-79 : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

Affected Products

• cpe:2.3:a:macromedia:coldfusion:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:internet_information_services:5.0:*:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*

← Back to Home