VulnerabilityModified
CVE-2005-2480
Cross-site scripting (XSS) vulnerability in ColdFusion Fusebox 4.1.0 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter, which is not quoted in an error page, as demonstrated using index.cfm.
MEDIUM 4.3EPSS 3.61%
Does this matter?
Lower severity and a low EPSS score (3.61%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in ColdFusion Fusebox 4.1.0 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter, which is not quoted in an error page, as demonstrated using index.cfm.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 3.61% probability · 89th percentile
- CISA KEV
- Not listed
- Affected
- macromedia/coldfusion fusebox
- Source
- cve@mitre.org
References
- http://marc.info/?l=bugtraq&m=112309656102615&w=2
- http://secunia.com/advisories/16320Vendor Advisory
- http://www.securityfocus.com/bid/14460Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/21697
- http://marc.info/?l=bugtraq&m=112309656102615&w=2
- http://secunia.com/advisories/16320Vendor Advisory
- http://www.securityfocus.com/bid/14460Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/21697
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.