VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Nov 17, 2023· Updated Jun 17, 2026

CVE-2023-44352

CVE-2023-44352

Description

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

Affected products

21
  • Adobe Inc./Coldfusion21 versions
    cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*+ 20 more
    • cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*range: <2021
    • cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*
    • cpe:2.3:a:adobe:coldfusion:2021:update10:*:*:*:*:*:*
    • cpe:2.3:a:adobe:coldfusion:2021:update11:*:*:*:*:*:*
    • cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*
    • cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*
    • cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*
    • cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*
    • cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*
    • cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*
    • cpe:2.3:a:adobe:coldfusion:2021:update7:*:*:*:*:*:*
    • cpe:2.3:a:adobe:coldfusion:2021:update8:*:*:*:*:*:*
    • cpe:2.3:a:adobe:coldfusion:2021:update9:*:*:*:*:*:*
    • cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*
    • cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*
    • cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*
    • cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*
    • cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*
    • cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*
    • (no CPE)range: <=2023.5, <=2021.11
    • (no CPE)range: 0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.