CVE-2005-1555

Cross-site scripting (XSS) vulnerability in the JRun Web Server in ColdFusion MX 7.0 allows remote attackers to inject arbitrary script or HTML via the URL, which is not properly quoted in the resulting default 404 error page.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.macromedia.com/devnet/security/security_zone/mpsb05-03.html	Patch Vendor Advisory
http://marc.info/?l=bugtraq&m=111575500403231&w=2
https://exchange.xforce.ibmcloud.com/vulnerabilities/20550

Configurations

Configuration 1 (hide)

cpe:2.3:a:macromedia:coldfusion:7.0:*:*:*:*:*:*:*

Information

Published : 2005-05-09 21:00

Updated : 2017-07-10 18:32

NVD link : CVE-2005-1555

Mitre link : CVE-2005-1555

JSON object : View

CWE

NVD-CWE-Other

Products Affected

macromedia

coldfusion

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.macromedia.com/devnet/security/security_zone/mpsb05-03.html", "name": "http://www.macromedia.com/devnet/security/security_zone/mpsb05-03.html", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://marc.info/?l=bugtraq&m=111575500403231&w=2", "name": "20050510 New Macromedia Security Zone Bulletin Posted", "tags": [], "refsource": "BUGTRAQ"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/20550", "name": "coldfusion-mx7-default-page-xss(20550)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the JRun Web Server in ColdFusion MX 7.0 allows remote attackers to inject arbitrary script or HTML via the URL, which is not properly quoted in the resulting default 404 error page."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2005-1555", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2005-05-10T04:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:macromedia:coldfusion:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-11T01:32Z"}

4.3 /10