Login Request a demo
Unscored severity · published Dec 31, 2002
CVE-2002-1700
Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by…
–
CVSS
24.3%
EPSS
No
On KEV
Description
Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not filtered in the resulting 404 error message.
Exploitation
Is it being used?
Exploit prediction (EPSS)24.3% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Coldfusion · Macromedia
6.0 · source: NVD
II
Internet Information Services · Microsoft
5.0 · source: NVD
W2
Windows 2000 · Microsoft
All versions, or not specified · source: NVD
Affected product
CO
Coldfusion
Macromedia
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-1700
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-1700
online.securityfocus.com
http://online.securityfocus.com/archive/1/277487
www.macromedia.com
http://www.macromedia.com/v1/Handlers/index.cfm?ID=23047
www.securityfocus.com
http://www.securityfocus.com/bid/5011
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/9360
More from Coldfusion
5.5
CVE-2004-2331
ColdFusion MX 6.1 and 6.1 J2EE allows local users to bypass sandbox security restrictions and obtain sensitive information by using Java reflection methods to access trusted Java…
–
CVE-2006-3979
The AdminAPI of ColdFusion MX 7 allows attackers to bypass authentication by using "programmatic access" to the adminAPI instead of the ColdFusion Administrator
–
CVE-2006-2364
Cross-site scripting (XSS) vulnerability in the validation feature in Macromedia ColdFusion 5 and earlier allows remote attackers to inject arbitrary web script or HTML via a…
–
CVE-2005-4342
ColdFusion Sandbox on Adobe (formerly Macromedia) ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 does not throw an exception if the SecurityManager is disabled, which might allow…
–
CVE-2005-4343
Adobe (formerly Macromedia) ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 allows remote attackers to attach arbitrary files and send mail via a crafted Subject field, which is…