Medium severity6.1NVD Advisory· Published May 12, 2022· Updated Jun 17, 2026
CVE-2022-28818
CVE-2022-28818
Description
ColdFusion versions CF2021U3 (and earlier) and CF2018U13 are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Affected products
21cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*+ 20 more
- cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*range: <2018
- cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2018:update11:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2018:update12:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2018:update13:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2018:update2:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2018:update3:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2018:update4:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2018:update5:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2018:update6:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2018:update7:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2018:update8:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2018:update9:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*
- cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*
- (no CPE)range: CF2021U3 and earlier, CF2018U13
- (no CPE)range: unspecified
Patches
Vulnerability mechanics
References
1- helpx.adobe.com/security/products/coldfusion/apsb22-22.htmlnvdVendor Advisory
News mentions
0No linked articles in our index yet.