7.5

CVE-2017-11286

Adobe ColdFusion has an XML external entity (XXE) injection vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Adobe ≫ Coldfusion Version11.0 Update-
Adobe ≫ Coldfusion Version11.0 Updateupdate1
Adobe ≫ Coldfusion Version11.0 Updateupdate10
Adobe ≫ Coldfusion Version11.0 Updateupdate11
Adobe ≫ Coldfusion Version11.0 Updateupdate12
Adobe ≫ Coldfusion Version11.0 Updateupdate2
Adobe ≫ Coldfusion Version11.0 Updateupdate3
Adobe ≫ Coldfusion Version11.0 Updateupdate4
Adobe ≫ Coldfusion Version11.0 Updateupdate5
Adobe ≫ Coldfusion Version11.0 Updateupdate6
Adobe ≫ Coldfusion Version11.0 Updateupdate7
Adobe ≫ Coldfusion Version11.0 Updateupdate8
Adobe ≫ Coldfusion Version11.0 Updateupdate9
Adobe ≫ Coldfusion Version2016 Update-
Adobe ≫ Coldfusion Version2016 Updateupdate1
Adobe ≫ Coldfusion Version2016 Updateupdate2
Adobe ≫ Coldfusion Version2016 Updateupdate3
Adobe ≫ Coldfusion Version2016 Updateupdate4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.29% 0.791
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

http://www.securitytracker.com/id/1039321
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/100715
Third Party Advisory
VDB Entry