CVE-2002-1700
Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 24.3%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not filtered in the resulting 404 error message.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 24.27% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- macromedia/coldfusion · microsoft/internet information services · microsoft/windows 2000
- Source
- cve@mitre.org
References
- http://online.securityfocus.com/archive/1/277487
- http://www.macromedia.com/v1/Handlers/index.cfm?ID=23047
- http://www.securityfocus.com/bid/5011
- https://exchange.xforce.ibmcloud.com/vulnerabilities/9360
- http://online.securityfocus.com/archive/1/277487
- http://www.macromedia.com/v1/Handlers/index.cfm?ID=23047
- http://www.securityfocus.com/bid/5011
- https://exchange.xforce.ibmcloud.com/vulnerabilities/9360
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.