CVE-2023-44352: medium-severity vulnerability in Adobe ColdFusion
Unauthenticate Reflected XSS on Adobe Coldfusion 2018 - 2021 - 2023 last version
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
A security flaw in Adobe ColdFusion allows attackers to inject malicious code into web pages through specially crafted links. When a victim clicks the link, the attacker's code runs in their browser, potentially stealing information or performing actions on their behalf.
Reflected XSS vulnerability in Adobe ColdFusion 2023.5 and earlier, 2021.11 and earlier allows unauthenticated attackers to inject arbitrary JavaScript via malicious URLs. The attack requires user interaction (clicking a link) and executes in the victim's browser context, enabling session hijacking, credential theft, or malware distribution.
In the same product, most dangerous first.