Adobe ColdFusion Multiple Vulnerabilities (APSA13-03)

medium Nessus Plugin ID 66404

Language:

Synopsis

A web-based application running on the remote host is affected by multiple vulnerabilities.

Description

The version of Adobe ColdFusion running on the remote host is affected by the following vulnerabilities :

- A directory traversal vulnerability exists in /administrator/mail/download.cfm. A remote, authenticated attacker can exploit this issue to download arbitrary files.

- A local file include vulnerability exists in /adminapi/customtags/l10n.cfm. A remote, unauthenticated attacker can exploit this to execute local cfm files.

A remote, unauthenticated attacker can exploit both of these vulnerabilities, resulting in the download of arbitrary files as demonstrated in this plugin report.

Solution

Apply the appropriate hotfix referenced in Adobe security bulletin APSB13-13.

Plugin Details

Severity: Medium

ID: 66404

File Name: coldfusion_apsa13-03.nasl

Version: 1.19

Type: remote

Family: CGI abuses

Published: 5/14/2013

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

CPE: cpe:/a:adobe:coldfusion

Required KB Items: installed_sw/ColdFusion

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 5/14/2013

Vulnerability Publication Date: 5/8/2013

Exploitable With

Core Impact

Reference Information

CVE: CVE-2013-3336

BID: 59773

Detections

Analytics