Vulnerability Details : CVE-2009-1872

Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the startRow parameter to administrator/logviewer/searchlog.cfm, or the query string to (2) wizards/common/_logintowizard.cfm, (3) wizards/common/_authenticatewizarduser.cfm, or (4) administrator/enter.cfm.

Vulnerability category: Cross site scripting (XSS)

Published 2009-08-18 22:30:00

Updated 2018-10-10 19:38:33

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2009-1872

Probability of exploitation activity in the next 30 days: 36.57%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 97 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2009-1872

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	[email protected]
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2009-1872

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: [email protected] (Primary)

References for CVE-2009-1872

http://www.securityfocus.com/archive/1/505803/100/0/threaded
http://www.dsecrg.com/pages/vul/show.php?id=122

Exploit
http://www.adobe.com/support/security/bulletins/apsb09-12.html

Patch;Vendor Advisory

CVEs referencing this url

Products affected by CVE-2009-1872

Adobe » Coldfusion
Versions up to, including, (<=) 8.0.1
cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 7.0 Linux Edition
cpe:2.3:a:adobe:coldfusion:7.0:*:linux:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 7.0.1
cpe:2.3:a:adobe:coldfusion:7.0.1:*:*:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 7.0.2
cpe:2.3:a:adobe:coldfusion:7.0.2:*:*:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 6.1
cpe:2.3:a:adobe:coldfusion:6.1:*:*:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 7.0
cpe:2.3:a:adobe:coldfusion:7.0:*:*:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 6.1 Enterprise Server Edition
cpe:2.3:a:adobe:coldfusion:6.1:*:enterprise_server:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 7.0 Enterprise Multi-server Edition
cpe:2.3:a:adobe:coldfusion:7.0:*:enterprise_multi-server:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 7.0 Enterprise Server Edition
cpe:2.3:a:adobe:coldfusion:7.0:*:enterprise_server:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 7.0 Solaris Edition
cpe:2.3:a:adobe:coldfusion:7.0:*:solaris:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 8.0
cpe:2.3:a:adobe:coldfusion:8.0:*:*:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 8.1
cpe:2.3:a:adobe:coldfusion:8.1:*:*:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 7.2 Update Unknown MX Edition
cpe:2.3:a:adobe:coldfusion:7.2:unknown:mx:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 6.0
cpe:2.3:a:adobe:coldfusion:6.0:*:*:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 6.0 Enterprise Server Edition
cpe:2.3:a:adobe:coldfusion:6.0:*:enterprise_server:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 6.1 Solaris Edition
cpe:2.3:a:adobe:coldfusion:6.1:*:solaris:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 6.0 Solaris Edition
cpe:2.3:a:adobe:coldfusion:6.0:*:solaris:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 6.1 Linux Edition
cpe:2.3:a:adobe:coldfusion:6.1:*:linux:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 6.0 Enterprise Multi-server Edition
cpe:2.3:a:adobe:coldfusion:6.0:*:enterprise_multi-server:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 6.1 Enterprise Multi-server Edition
cpe:2.3:a:adobe:coldfusion:6.1:*:enterprise_multi-server:*:*:*:*:*
Matching versions
Adobe » Coldfusion » Version: 6.0 Linux Edition
cpe:2.3:a:adobe:coldfusion:6.0:*:linux:*:*:*:*:*
Matching versions