CVE-2006-5859
Current Description
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 7 7.0 and 7.0.1, when Global Script Protection is not enabled, allows remote attackers to inject arbitrary HTML and web script via unknown vectors, possibly related to Linkdirect.cfm, Topnav.cfm, and Welcomedoc.cfm.
Evaluator Description
Successful exploitation requires that Global Script Protection is not enabled.
Basic Data
Published | February 14, 2007 |
---|---|
Last Modified | March 08, 2011 |
Assigner | cve@mitre.org |
Data Type | CVE |
Data Format | MITRE |
Data Version | 4.0 |
Problem Type | CWE-79 |
CVE Data Version | 4.0 |
Base Metric V2
CVSS 2 - Version | 2.0 |
---|---|
CVSS 2 - Vector String | AV:N/AC:M/Au:N/C:N/I:P/A:N |
CVSS 2 - Access Vector | NETWORK |
CVSS 2 - Access Complexity | MEDIUM |
CVSS 2 - Authentication | NONE |
CVSS 2 - Confidentiality Impact | NONE |
CVSS 2 - Availability Impact | NONE |
CVSS 2 - Base Score | 4.3 |
Severity | MEDIUM |
Exploitability Score | 8.6 |
Impact Score | 2.9 |
Obtain All Privilege | false |
Obtain User Privilege | false |
Obtain Other Privilege | false |
Base Metric V3
No data provided.
Configurations
-
OR - Configuration 1
Cpe Version Part Vendor Product Version Update Edition Language SW Edition Target SW Target HW Other Version Start Including Version End Including Version Start Excluding Version End Excluding 2.3 Application Adobe Coldfusion 7.0 * * * * * * *