Reflected XSS in Adobe ColdFusion

Executive Summary

This vulnerability is a reflected Cross-Site Scripting (XSS) issue affecting ColdFusion versions 2025.9, 2023.20, and earlier. It allows an attacker to inject malicious scripts into a web page that is viewed by a user. The malicious script runs in the context of the current user, potentially enabling arbitrary code execution. Exploitation requires the victim to interact by opening a malicious link.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can lead to arbitrary code execution within the context of the affected user. This means an attacker could perform actions on behalf of the user, steal sensitive information, hijack user sessions, or manipulate web content. The attack requires user interaction, specifically the victim opening a malicious link.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability is a reflected Cross-Site Scripting (XSS) issue that could allow an attacker to inject malicious scripts and potentially execute arbitrary code in the context of the current user. Such vulnerabilities can lead to unauthorized access or exposure of sensitive data.

Exploitation of this vulnerability could impact compliance with data protection regulations such as GDPR and HIPAA, as these standards require protection against unauthorized access and data breaches. If exploited, the vulnerability might lead to compromise of personal or protected health information, thereby violating these regulations.

However, the provided information does not explicitly state the direct impact on compliance or any specific regulatory considerations.

Useful 0 Not Useful 0