Detections
Analytics
Adobe ColdFusion HTTP Response Splitting (APSB12-15)
medium Nessus Plugin ID 59715
Language:
Synopsis
An application hosted on the remote web server is affected by an HTTP response splitting vulnerability.Description
The version of Adobe ColdFusion running on the remote host is affected by an HTTP response splitting vulnerability.The coldfusion.filter.ComponentFilter class does not properly sanitize input used in the Location header of an HTTP response. A remote attacker can exploit this by tricking a user into making a malicious request, resulting in the injection of HTTP headers, modification of the HTTP response body, or splitting the HTTP response into multiple responses.
Solution
Apply the hotfixes referenced in Adobe advisory APSB12-15.See Also
https://www.adobe.com/support/security/bulletins/apsb12-15.html
Plugin Details
Severity: Medium
ID: 59715
File Name: coldfusion_apsb12-15.nasl
Version: 1.17
Type: remote
Family: CGI abuses
Published: 6/26/2012
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 2.7
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.6
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:adobe:coldfusion
Required KB Items: installed_sw/ColdFusion
Exploit Available: true
Exploit Ease: Exploits are available
Exploited by Nessus: true
Patch Publication Date: 6/12/2012
Vulnerability Publication Date: 6/12/2012
Reference Information
CVE: CVE-2012-2041
BID: 53941